【发布时间】:2016-09-08 19:56:54
【问题描述】:
这是我第一次尝试 PHP,但运气不佳。
数据库是在 phpmyadmin 中创建的,需要的表以相同的顺序 我正在运行 Ubuntu 14.04.1 LTS 5.5.49-MariaDB-1ubuntu0.14.04.1 (Ubuntu) PHP 5.5.9-1ubuntu4.19 (cli)
a.html 的内容:
<form method="post" action="aplicatie.php" name="ClaimForm" id="ClaimForm" autocomplete="on">
<fieldset>
<legend>Completeaza detaliile tale:</legend>
<div>
<label for="numecont" accesskey="U">Numele contului</label>
<input name="numecont" type="text" id="numecont" placeholder="ex: RSC_Alex" required />
</div>
<div>
<label for="wn8overall" accesskey="U">WN8 Actual</label>
<input name="wn8overall" type="text" id="wn8overall" placeholder="ex: 1800" required />
</div>
<div>
<label for="wn8recent">WN8 Recent</label>
<input name="wn8recent" type="text" id="wn8recent" placeholder="ex: 2700" required />
</div>
<div>
<label for="email" accesskey="E">Email</label>
<input name="email" type="email" id="email" placeholder="ex: admin@arcan.ro" pattern="^[A-Za-z0-9](([_\.\-]?[a-zA-Z0-9]+)*)@([A-Za-z0-9]+)(([\.\-]?[a-zA-Z0-9]+)*)\.([A-Za-z]{2,})$" required />
</div>
<label for="tara">Tara de resedinta</label>
<input name="tara" type="text" id="tara" placeholder="ex: Romania" required />.
<div>
<label for="zileonline" accesskey="X">Cate zile pe saptamana poti fi activ incepand cu ora 20:00 (GMT+2)?</label>
<select name="zileonline" id="zileonline" required="required">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
</select>
</div>
</fieldset>
<fieldset>
<legend>Tancuri disponibile in garaj</legend>
<div>
<label for="tank10" accesskey="S">Numar de tancuri de nivel 10</label>
<select name="tank10" id="tank10" required="required">
<option value="0">0</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
<option value="8">8</option>
<option value="9">9</option>
<option value="10">10</option>
<option value="peste10"> >10</option>
</select>
</div>
<div>
<label for="tank8" accesskey="C">Numar de tancuri de nivel 8</label>
<select name="tank8" id="tank8" required="required">
<option value="0">0</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="peste5"> >5</option>
</select>
</div>
<div>
<label for="careclan" accesskey="T">Pentru care din clanuri doresti sa aplici?</label>
<select name="careclan" id="careclan" required="required">
<option value="ARCAN">ARCAN</option>
<option value="ARKNE">ARKNE</option>
<option value="ARKAN">ARKAN</option>
</select>
</div>
</fieldset>
<input type="submit" class="submit" id="submit" value="Vreau sa aplic" />
aplicatie.php 的内容:
<?php
$mysql_host = "localhost";
$mysql_username = "root";
$mysql_password = "pass";
$mysql_database = "aplicatii";
$conn= new mysqli ($mysql_host,$mysql_username,$mysql_password,$mysql_database);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";
$prepare="INSERT INTO `aplicatii1` (`wn8overall`,`wn8recent`,`email`,`zileonline`,`tara`,`tank10`,`tank8`,`careclan`,`numecont`) VALUES ($_POST['wn8overall'], $_POST['wn8recent'], $_POST['email'], $_POST['zileonline'], $_POST['tara'], $_POST['tank10'], $_POST['tank8'], $_POST['careclan'], $_POST['numecont'])";
if ($conn->query($prepare) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $prepare . "<br>" . $conn->error;
}
mysqli_close($conn);
?>
【问题讨论】:
-
首先 - 学习关于引号,然后 - 关于准备好的陈述。
-
将您的 $_POST 变量放入 {} 中,这样您的查询将变为: $prepare="INSERT INTO
aplicatii1(wn8overall,wn8recent,email,zileonline,@987654333 @,tank10,tank8,careclan,numecont) 值 ({$_POST['wn8overall']}, {$_POST['wn8recent']}, {$_POST['email']}, {$_POST['zileonline']},{$_POST['tara']},{$_POST['tank10']},{$_POST['tank8']},{$_POST['careclan']}, {$_POST['numecont']})";另请参阅trans4mind.com/personal_development/phpTutorial/quotes.htm -
非常有帮助的伙伴
-
@SankalpSrivastava 与core documentation on PHP strings 相比,该教程非常糟糕。这也是100%错误的。不要将
$_POST数据放在查询中。 -
警告:当使用
mysqli时,您应该使用parameterized queries 和bind_param将用户数据添加到您的查询中。 不要使用字符串插值或连接来完成此操作,因为您创建了一个严重的SQL injection bug。 切勿将$_POST或$_GET数据直接放入查询中,如果有人试图利用您的错误,这可能会非常有害。