PHP SQL / 您的 SQL 语法有错误答案

【问题标题】：PHP SQL / You have an error in your SQL syntaxPHP SQL / 您的 SQL 语法有错误
【发布时间】：2014-04-21 03:59:47
【问题描述】：

我在尝试将用户变量插入数据库时遇到了一些严重的困难。我不断收到错误您的 SQL 语法有错误。我已经搜索了几天表格并尝试了不同的解决方案，但无济于事。我尝试使用 '$var' ， '".$var."' ， "$var" 但没有运气。如果我使用不带引号的 $var，则会收到错误 列数与第 1 行的值计数不匹配。任何帮助将不胜感激。谢谢。

代码sn-p和数据表如下。

$con= mysqli_connect("oni", "mul", "kjnbiunvtr","mul"); 

if (mysqli_connect_errno($con))
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$drugName=$_POST['drugName']; 
$drugName=mysql_real_escape_string($drugName);

$treats=$_POST['treats'];
$treats=mysql_real_escape_string($treats);

$effects=$_POST['effects']; 
$effects =mysql_real_escape_string($effects);

$sideEffect=$_POST['SideEffects']; 
$sideEffect= mysql_real_escape_string($sideEffect);

$sideEffect2=$_POST['SideEffects2']; 
$sideEffect2=mysql_real_escape_string($sideEffect2);

$sideEffect3=$_POST['SideEffects3']; 
$sideEffect3= mysql_real_escape_string($sideEffect3);

$sql=mysqli_query($con,"INSERT INTO Drug(drug) VALUES('$drugName')");

if (mysqli_query($con,$sql))
{
    echo "Drug insertion successful : ";
    echo "\r\n";
}
else
{
    echo "Error 1 :  " . mysqli_error($con);
    echo "\r\n";
}

表格：

$sql1="CREATE TABLE Drug
    (Id int (11) NOT NULL AUTO_INCREMENT,
        PRIMARY KEY(Id),
        drug VARCHAR(50) NOT NULL
    )ENGINE=INNODB;";


$sql2="CREATE TABLE DrugSideEffect
    ( Id int (11) NOT NULL AUTO_INCREMENT,
        D_Id int (11) NOT NULL,
        SE_Id int (11) NOT NULL,
        PRIMARY KEY(Id),
        FOREIGN KEY (SE_Id) REFERENCES SideEffect(Id),
        FOREIGN KEY (D_Id) REFERENCES Drug(Id)
        ON DELETE CASCADE
        ON UPDATE CASCADE
    )ENGINE=INNODB;";


$sql3="CREATE TABLE Treatment
    (Id INT NOT NULL AUTO_INCREMENT,
        T_Id int (11) NOT NULL,
        Descr VARCHAR (250) NOT NULL,
        PRIMARY KEY(Id),
        FOREIGN KEY (T_Id) REFERENCES Drug(Id)
        ON DELETE CASCADE
        ON UPDATE CASCADE
    )ENGINE=INNODB;";


$sql4="CREATE TABLE Effects
    (Id INT NOT NULL AUTO_INCREMENT,
        E_Id int (11) NOT NULL,
        Descr VARCHAR (250) NOT NULL,
        PRIMARY KEY(Id),
        FOREIGN KEY (E_Id) REFERENCES Drug(Id)
        ON DELETE CASCADE
        ON UPDATE CASCADE
    )ENGINE=INNODB;";


$sql5="CREATE TABLE SideEffect
    (Id int (11) NOT NULL AUTO_INCREMENT,
        PRIMARY KEY(Id),
        Descr VARCHAR (250) NOT NULL
    )ENGINE=INNODB";

【问题讨论】：

什么是失败的 SQL？
您的第一个查询对 SQL 注入开放。请改用prepared statements。
使用 mysqli 转义字符串将两者混合。并显示错误消息。
为什么不把这份工作留给有线索的人呢？从数据库设计到语法问题，存在如此多的缺陷，没有一个答案可以解决所有问题。
旁注：=> 你将mysql_* 与mysqli_* 函数混合在一起。

标签： php sql database mysqli

【解决方案1】：

也许您的 MySQL 版本 >= 5.5 并且不推荐使用 mysql_real_escape_string 函数。您可以尝试使用mysqli_real_escape_string 方法，如下例所示。

$con= mysqli_connect("oni", "mul", "kjnbiunvtr","mul"); 

if (mysqli_connect_errno($con))
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$drugName=$_POST['drugName']; 
$drugName=mysqli_real_escape_string($con, $drugName);

$sql=mysqli_query($con,"INSERT INTO Drug(drug) VALUES('$drugName')");

if (mysqli_query($con,$sql))
{
    echo "Drug insertion successful : ";
    echo "\r\n";
}
else
{
    echo "Error 1 :  " . mysqli_error($con);
    echo "\r\n";
}

【讨论】：

【解决方案2】：

试试这个

     $sql=mysqli_query($con,"INSERT INTO Drug (drug) VALUES ('".$drugName."')");

编辑：

您的问题在于创建表格。

您的表格排序不正确，您应该在DrugSideEffect 之前创建表格SideEffect。

试试这个顺序：

$sql1="CREATE TABLE Drug
(Id int (11) NOT NULL AUTO_INCREMENT,
    PRIMARY KEY(Id),
    drug VARCHAR(50) NOT NULL
)ENGINE=INNODB;";
 $sql5="CREATE TABLE SideEffect
(Id int (11) NOT NULL AUTO_INCREMENT,
    PRIMARY KEY(Id),
    Descr VARCHAR (250) NOT NULL
)ENGINE=INNODB";

$sql2="CREATE TABLE DrugSideEffect
( Id int (11) NOT NULL AUTO_INCREMENT,
    D_Id int (11) NOT NULL,
    SE_Id int (11) NOT NULL,
    PRIMARY KEY(Id),
    FOREIGN KEY (SE_Id) REFERENCES SideEffect(Id),
    FOREIGN KEY (D_Id) REFERENCES Drug(Id)
    ON DELETE CASCADE
    ON UPDATE CASCADE
)ENGINE=INNODB;";


$sql3="CREATE TABLE Treatment
(Id INT NOT NULL AUTO_INCREMENT,
    T_Id int (11) NOT NULL,
    Descr VARCHAR (250) NOT NULL,
    PRIMARY KEY(Id),
    FOREIGN KEY (T_Id) REFERENCES Drug(Id)
    ON DELETE CASCADE
    ON UPDATE CASCADE
)ENGINE=INNODB;";


$sql4="CREATE TABLE Effects
(Id INT NOT NULL AUTO_INCREMENT,
    E_Id int (11) NOT NULL,
    Descr VARCHAR (250) NOT NULL,
    PRIMARY KEY(Id),
    FOREIGN KEY (E_Id) REFERENCES Drug(Id)
    ON DELETE CASCADE
    ON UPDATE CASCADE
)ENGINE=INNODB;";

【讨论】：

这是问题中描述的试验之一

【解决方案3】：

$con= mysqli_connect("oni", "mul", "kjnbiunvtr","mul");

if (mysqli_connect_errno($con)) { echo "Failed to connect to MySQL: " . mysqli_connect_error(); }

$drugName=$_POST['drugName'];

$drugName=mysqli_real_escape_string($con, $drugName);

$sql=mysqli_query($con,"INSERT INTO Drug(drug) VALUES('$drugName')");

if (mysqli_query($con,$sql)){ echo "Drug insertion successful : "; echo "\r\n"; } else { echo "Error 1 : " . mysqli_error($con); echo "\r\n"; }

【讨论】：