【发布时间】：2019-11-01 14:54:54
【问题描述】：
有很多这样的错误，但这个是我的。
我有一个 PHP 票务类型表单，我想将信息插入 MYSQL 数据库。
这是 PHP 表单：
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8">
<title></title>
</head>
<body>
<form name="ticket-form" id="ticket-form" action="get_response.php" method="POST">
<p>Please provide your first name: <input type="text" name="firstName" id="firstName" placeholder="John" required></p>
<p>Please provide your last name: <input type="text" name ="lastName" id="lastName" placeholder="Smith" required></p>
<p>Please indicate if you are a company or a contractor:
<input type="radio" name="clientType" id="clientType" value="company">Company
<input type="radio" name="clientType" id="clientType" value="contractor" checked>Contractor</p>
<p>Please provide an email address: <input type="email" name="email" id="email" placeholder="John123@example.com"><br></p>
<p>Please provide a phone number if you'd prefer: <input type="text" name="number" id="number" max="13" placeholder="07654321234"><br></p>
<p>Please detail your query, going in to as much detail as possible: </p>
<textarea name="query" id="query" rows="8" cols="80" placeholder="Please detail the nature of your issue, going in to as much detail as possible."></textarea><br><br>
<input type="submit" name="submit" value="Submit">
</form>
</body>
</html>
这里是get_response.php
<?php
require_once("config.php");
require_once("index.php");
$datetime = new DateTime();
$datestring = $datetime->format('d-m-Y H:i:s');
$first_name = mysqli_real_escape_string($conn, $_POST['firstName']);
$second_name = mysqli_real_escape_string($conn, $_POST['lastName']);
$client_type = mysqli_real_escape_string($conn, $_POST['clientType']);
$email_address = mysqli_real_escape_string($conn, $_POST['email']);
$query = mysqli_real_escape_string($conn, $_POST['query']);
$phone_number = mysqli_real_escape_string($conn, $_POST['number']);
$sql = "INSERT INTO
tickets (first_name, second_name, client_type, email_address, phone_number, query)
VALUES
('$first_name', '$second_name', '$client_type', '$email_address', '$phone_number', '$query')";
if($conn->query($sql)){
echo "<p>Thank you for your email!</p>
<p> We aim to respond to your query as soon as possible.
Please allow 2 business days for a response and check spam folders.</p>";
}
else
{
die('There was an error running the query [' . mysqli_error($conn) . ']');
}
// else
// {
// echo "<p>Please supply valid information.</p>";
// }
mysqli_close($conn);
?>
php config.php
将表明与 $conn 变量的连接成功，但要消除该问题：
<?php
$servername = "xxxxx";
$username = "xxxxx";
$password = "xxxxx";
$dbname = "tickets";
$conn = mysqli_connect($servername, $username, $password, $dbname);
if($conn->connect_error){
die("Connection failed: " . $conn->connect_error);
} ?>
php get_response.php
将空数据插入数据库。然而，表单无法通过发布信息来工作。
我知道可能还有其他错误。我对 PHP 和 MYSQL 很陌生。任何帮助深表感谢。提前致谢。
编辑：根据要求提供一些错误日志。这就是今天的全部内容。
[Fri Nov 01 12:24:51.342604 2019] [mpm_event:notice] [pid 673:tid 140589056359360] AH00489: Apache/2.4.38 (Ubuntu) configured -- resuming normal operations
[Fri Nov 01 12:24:51.343298 2019] [core:notice] [pid 673:tid 140589056359360] AH00094: Command line: '/usr/sbin/apache2'
Edit2：已解决，排序。
我尝试在我的常规 Mac OS X 操作系统中重新制作表单，它运行良好。虚拟盒子似乎存在根本性的问题，它与现代 OS X 软件的通信方式或某些个人配置。虽然我可以在 Linux 命令行中连接到 mysql，但它无法通过表单工作。
【问题讨论】：
-
您对 SQL 注入持开放态度，应该立即解决
-
您的脚本面临SQL Injection Attacks 的风险。使用prepared statements。即使escaping 字符串也不安全！
-
您在 Web 服务器日志中遇到什么错误？
-
所以它正在插入，但插入的是空值？请打开错误报告，然后报告错误 - stackoverflow.com/questions/1053424/… 和 phpdelusions.net/mysqli/error_reporting
-
你需要做一些调试来帮助我们。你能告诉我们
var_dump($_POST)、var_dump($first_name)和var_dump($sql)的输出吗？
标签： php html mysql database forms