如何插入包含超过 100 个字段的表单答案

【问题标题】：How do I insert into a form with over 100 fields如何插入包含超过 100 个字段的表单
【发布时间】：2013-04-30 01:47:18
【问题描述】：

我创建了一个用户表单，一旦按下提交按钮，我想将数据发送/插入到 mysql 数据库中，添加一条新记录。该表单有 100 多个输入字段。我怎样才能做到这一点。这是我的示例 php 代码。

    <html>
<head>
</head>
<body>
<?php
if (isset($_POST['submit'])){


//Variables for connecting to your database.
            //These variable values come from your hosting account.
            $hostname = "hostname";
            $username = "username";
            $password = "password";
            $dbname = "dbname";
            $mystuff = "tenant_lname","tenant_fname","tenant_mname","ssn","dl_number","dl_state","birthday","tenant_hphone","tenant_wphone","tenant_cphone","curr_street","curr__unit","curr_city","curr_state","curr_zip","how_long_from","how_long_to","last_rent_mnt","last_rent_amt","own_man_name","own_man_tel","curr_reason","pre_street","pre_unit","pre_city","pre_state","pre_zip","pre_from","pre_to","pre_last_rent","pre_amt","pre_owner","pre_owner_tel","pre_reason","sec_pre_street","sec_pre_unit","sec_pre_city","sec_pre_state","sec_pre_zip","sec_pre_from","sec_pre_to","sec_pre_last_paid_mnt","sec_pre_amt","sec_pre_owner","sec_pre_owner_tel","sec_pre_reason","curr_emp_name","curr_emp_add","curr_emp_phone","curr_emp_pos","curr_emp_bus_type","curr_emp_sup","curr_emp_from","curr_emp_to","curr_emp_salary","pre_emp_name","pre_emp_add","pre_emp_phone","pre_emp_pos","pre_emp_bus_type","pre_emp_sup_name","pre_emp_from","pre_emp_to","pre_emp_salary","move_date","addntl_occ_name","addntl_occ_age","addntl_occ_relation","addntl_ft","addntl_pt","addntl_occ1_name","addntl_occ1_age","addntl_occ1_relation","addntl_occ1_ft","addntl_occ1_pt","addntl_occ2_name","addntl_occ2_age","addnt2_occ1_relation","addntl_occ2_ft","addntl_occ2_pt","addntl_occ3_name","addntl_occ3_age","addntl_occ3_relation","addntl_occ3_ft","addntl_occ3_pt","credit_yes","credit_no","det_yes","det_no","evict_yes","evict_no","bnkry_yes","bnkry_no","fel_yes","fel_no","pet_yes","pet_no","pet_numb","pet_type","furn_yes","furn_no","ins_cov_yes","ins_cov_no","ints_yes","ints_no","ints_type","smoke_yes","smoke_no","occ_smoke_yes","occ_smoke_no","explain_smoke","bnk_name","bnk_add","checking","checking_bal","saving","saving_bal","bnk_name1","bnk_add1","checking1","checking_bal1","saving1","saving_bal1","other_income","credit_name","credit_add","credit_city","credit_acct","credit_bal","credit_payment","credit_name1","credit_add1","credit_city1","credit_acct1","credit_bal1","credit_payment1","credit_acct2_name","credit_add2","credit_city2","credit_acc2","credit_bal2","credit_payment2","credit_acc3_name","credit_acc3_add","credit_acc3_city","credit_acc3_number","credit_acc3_bal","credit_acc3_payment","emer_contact_name","emer_contact_add","emer_relation","emer_phone","reg_owner_yes","reg_owner_no","reg_who","vehicle_year","vehicle_make","vehicle_model","vehicle_color","vehicle_license","veh_state","vehicle2_year","vehicle2_make","vehicle2_model","vehicle2_color","vehicle2_license","veh2_state";



$con = mysql_connect("$hostname","$username","$password");
if (!$con){
die ("Can not connect:" . mysql_error());   
}

mysql_select_db("dbname",$con);

$sql = "INSERT INTO dbname ($mystuff) VALUES ('$_POST[$mystuff]')";

mysql_query($sql,$con);

mysql_close($con);
}
?>
</body>
</html>

【问题讨论】：

我想在不输入所有字段名称的情况下这样做
1.不要在 php 中使用 mysql 扩展，因为它已被弃用 2. 使用 pdo 进行参数化查询
@Don Austin：你基本上是在寻找一个叫做数组的东西：php.net/array，然后是一个叫做loops的东西——剩下的就像你似乎已经知道但采取的 HTML 表单和 SQL 查询注意您使用的数据库客户端库可以轻松编写不安全的代码，并且不再处于积极开发中。
为了安全起见，您确实需要输入所有字段名称。否则你将无法写robust SQL code。

标签： php mysql forms post insert-into

【解决方案1】：

$mystuff 应该是一个数组。

您可以使用循环生成查询和表单。

如果这些用于生产用途，请进行验证！

$_POST 也是一个数组，所以 $_POST["field1", "field2", ...] 是一个语法错误。您一次只能访问一个密钥，例如$_POST['field1'] 。 '，' 。 $_POST['field2']

您可以使用implode() 用字符（例如','）连接数组中的所有值

重新考虑您的数据库架构！

未经测试：

    <html>
`enter code here`<head>
`enter code here`</head>
<body>
<?php
>if (isset($_POST['submit'])){

    //Variables for connecting to your database.
    //These variable values come from your hosting account.
    $hostname = "hostname";
    $username = "username";
    $password = "password";
    $dbname = "dbname";
    $mystuff = array(  "tenant_lname","tenant_fname","tenant_mname","ssn","dl_number","dl_state","birthday","tenant_hphone","tenant_wphone","tenant_cphone","curr_street","curr__unit","curr_city","curr_state","curr_zip","how_long_from","how_long_to","last_rent_mnt","last_rent_amt","own_man_name","own_man_tel","curr_reason","pre_street","pre_unit","pre_city","pre_state","pre_zip","pre_from","pre_to","pre_last_rent","pre_amt","pre_owner","pre_owner_tel","pre_reason","sec_pre_street","sec_pre_unit","sec_pre_city","sec_pre_state","sec_pre_zip","sec_pre_from","sec_pre_to","sec_pre_last_paid_mnt","sec_pre_amt","sec_pre_owner","sec_pre_owner_tel","sec_pre_reason","curr_emp_name","curr_emp_add","curr_emp_phone","curr_emp_pos","curr_emp_bus_type","curr_emp_sup","curr_emp_from","curr_emp_to","curr_emp_salary","pre_emp_name","pre_emp_add","pre_emp_phone","pre_emp_pos","pre_emp_bus_type","pre_emp_sup_name","pre_emp_from","pre_emp_to","pre_emp_salary","move_date","addntl_occ_name","addntl_occ_age","addntl_occ_relation","addntl_ft","addntl_pt","addntl_occ1_name","addntl_occ1_age","addntl_occ1_relation","addntl_occ1_ft","addntl_occ1_pt","addntl_occ2_name","addntl_occ2_age","addnt2_occ1_relation","addntl_occ2_ft","addntl_occ2_pt","addntl_occ3_name","addntl_occ3_age","addntl_occ3_relation","addntl_occ3_ft","addntl_occ3_pt","credit_yes","credit_no","det_yes","det_no","evict_yes","evict_no","bnkry_yes","bnkry_no","fel_yes","fel_no","pet_yes","pet_no","pet_numb","pet_type","furn_yes","furn_no","ins_cov_yes","ins_cov_no","ints_yes","ints_no","ints_type","smoke_yes","smoke_no","occ_smoke_yes","occ_smoke_no","explain_smoke","bnk_name","bnk_add","checking","checking_bal","saving","saving_bal","bnk_name1","bnk_add1","checking1","checking_bal1","saving1","saving_bal1","other_income","credit_name","credit_add","credit_city","credit_acct","credit_bal","credit_payment","credit_name1","credit_add1","credit_city1","credit_acct1","credit_bal1","credit_payment1","credit_acct2_name","credit_add2","credit_city2","credit_acc2","credit_bal2","credit_payment2","credit_acc3_name","credit_acc3_add","credit_acc3_city","credit_acc3_number","credit_acc3_bal","credit_acc3_payment","emer_contact_name","emer_contact_add","emer_relation","emer_phone","reg_owner_yes","reg_owner_no","reg_who","vehicle_year","vehicle_make","vehicle_model","vehicle_color","vehicle_license","veh_state","vehicle2_year","vehicle2_make","vehicle2_model","vehicle2_color","vehicle2_license","veh2_state");


    $sql_values=array();
    foreach($mystuff as $fieldname) {
        /* do validation! */

        $sql_values[$fieldname] = "'" . mysql_real_excape_stiring($_POST[$fieldname]) . "'";
    }


    $con = mysql_connect("$hostname","$username","$password");
    if (!$con){
        die ("Can not connect:" . mysql_error());
    }

    mysql_select_db("dbname",$con);

    $sql = "INSERT INTO dbname (".implode(',', $mystuff).") VALUES (" . implode(',', $sql_values) . ")";

    mysql_query($sql,$con);

    mysql_close($con);
}


foreach($mystuff as $fieldname) {
    echo "...an input field...";
}

?>



</body>

【讨论】：

【解决方案2】：

创建类似的输入：

<input type="text" name="datas[firstname]"/>
<input type="text" name="datas[lastname]"/>

您可以使用以下方法处理数据：

<?php

$datas = $_POST['datas'];
$columns = implode(",",array_keys($datas));

//add ' since mysql use ' for strings
$values = implode("','",$datas);

$sql = "INSERT INTO dbname (".$columns.") VALUES ('".$values."')";

希望对您有所帮助。

【讨论】：

$_POST 已经是一个数组，为什么不直接使用foreach($_POST as $k=>$v)？
迭代数组是一种替代解决方案，因为我们应该按照您上面的定义通过连接 $k 来构建列。是的，你是对的，$_POST['datas'] 已经是一个数组，所以与其迭代它，我更喜欢使用需要数组作为参数的 implode。
SQL 注入公司来了。
是的，我知道这些代码很容易被注入。我确实建议使用任何库/框架，但我回答的只是基本的。
此时我不相信我可以更改与我的抄送相关联的输入名称。我对这一切都是新手，现在你让我想知道如何使用 PDO 来帮助防止我一直在阅读的 SQL 注入。有没有另一种方法可以在不更改输入名称的情况下做到这一点？先感谢您。 @UsmanTiono