INSERT INTO 不为我插入

Question

我看不出这有什么问题，但它就是行不通。

快速纲要：在上一页填写的表格，$_POST['']'s 添加到 $_SESSION['']'s，$vars 从 $_SESSION['']'s 设置，$vars 用于mysqli_query。

我确定问题正困扰着我，但我就是看不到它。

代码如下：（已更新）

if(isset($_POST['list_make']) && $_POST['list_make'] != '') { $list_make  = $_POST['list_make']; $_SESSION['list_make'] = $list_make; }
if(isset($_SESSION['list_make']) && $_SESSION['list_make'] != '') { $list_make = $_SESSION['list_make']; } else { $list_make = ''; }

$add_car_query = "INSERT INTO car_details 
    (car_user_id, car_user_number, car_date_added, car_make, car_model, car_date_registered, car_odometer, 
        car_engine_size, car_color, car_body_type, car_owners, car_nct_date, car_rax_date) 
    VALUES 
    ('$user_id_new', '$new_user_number', '$today', '$list_make', '$list_model', '$list_year', '$list_kilometers', 
        '$list_engine_size', '$list_color', '$list_body_type', '$list_previous_owners', '$list_nct', '$list_tax')
    ";
if(mysqli_query($con, $add_car_query)) { $added = 'added'; } else { $added = 'Not happening'; }

Answer 1

尝试检查else中是否存在MySQLi错误（如果查询失败将触发）：

$add_car_query = "INSERT INTO car_details 
    (car_user_id, car_user_number, car_date_added, car_make, car_model, car_date_registered, car_odometer, 
        car_engine_size, car_color, car_body_type, car_owners, car_nct_date, car_rax_date) 
    VALUES 
    ('$user_id_new', '$new_user_number', '$today', '$list_make', '$list_model', '$list_year', '$list_kilometers', 
        '$list_engine_size', '$list_color', '$list_body_type', '$list_previous_owners', '$list_nct', '$list_tax')
    ";
if(mysqli_query($con, $add_car_query)) { 
  $added = 'added'; 
} 
else { 

  // check for the error here
  if(mysqli_error()) {
    echo mysqli_error();
  }

  $added = 'Not happening'; 
}

---

准备好的陈述

正如 cmets 中的某人所说，您应该使用 prepared statements 以获得更好的安全性。这样您就不必担心转义输入（看起来您现在没有转义值 very dangerous）。

不过，它可能会与问号占位符有点混淆（不幸的是，MySQLi 不支持命名参数）。准备好的语句使用 OOP MySQLi 更好，但是您使用的是过程，所以这里是您如何为您的问题中的查询执行准备好的语句：

$add_car_query = "INSERT INTO car_details 
    (car_user_id, 
     car_user_number, 
     car_date_added, 
     car_make, 
     car_model, 
     car_date_registered, 
     car_odometer, 
     car_engine_size, 
     car_color, 
     car_body_type, 
     car_owners, 
     car_nct_date, 
     car_rax_date) 
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";

$stmt = mysqli_stmt_prepare($con, $add_car_query);

// if any of the values are an int, change the 
// corresponding 's' (which means string) to 'i' (integer).
// more info: http://us.php.net/manual/en/mysqli-stmt.bind-param.php

mysqli_stmt_bind_param($stmt, 'sssssssssssss', 
                       $user_id_new, 
                       $new_user_number, 
                       $today, 
                       $list_make, 
                       $list_model, 
                       $list_year, 
                       $list_kilometers, 
                       $list_engine_size, 
                       $list_color, 
                       $list_body_type, 
                       $list_previous_owners, 
                       $list_nct, 
                       $list_tax);
$stmt_exe = mysqli_stmt_execute($stmt);

if($stmt_exe) { 
   $added = 'added'; 
} 
else { 
   if(mysqli_error()) {
     echo mysqli_error();
   }
   $added = 'Not happening'; 
}