【发布时间】:2014-02-08 12:56:22
【问题描述】:
所以我有这个表格。我想将数据存储到我的数据库中。但是,事实并非如此,也没有错误日志。非常感谢您的帮助,因为它会在 2 天内到期,而且我在过去一周左右一直在尝试。
<form enctype="multipart/form-data" action="preview.php" method="post" class="f">
<p>
<p>
<p><label for="name">Teacher's Name:</label>
<input type="text" style="font-family:Gloria Hallelujah" size="35" name="name" id="name" autofocus required></p>
<p><label for="name">Title:</label>
<input type="text" style="font-family:Gloria Hallelujah" size="35" name="title" id="title" autofocus required></p>
<p><label for="done">Done By:</label>
<input type="text" style="font-family:Gloria Hallelujah" size="35" name="done" id="done" required></p>
<p><label for="no">Class:</label>
<input type="text" style="font-family:Gloria Hallelujah" size="15" name="class" id="no" required></p>
<p><label for="sch">School:</label>
<select name="sch">
<option value="seg">School of Engineering (SEG)</option>
<option value="sit">School of Information Technology (SIT)</option>
<option value="sdn">School of Design (SDN)</option>
<option value="sbm">School of Business Management (SBM)</option>
<option value="shs">School of Health Sciences (SHS)</option>
<option value="scl">School of Chemical & Life Sciences (SCL)</option>
<option value="sidm">School of Interactive and Digital Media (SIDM)</option>
</select>
<p><label for="msg">Show your Gratitude! :</label>
<textarea class="tarea" maxlength="3000" cols="38.5" rows="6" name="comments" placeholder="Enter Message here..." required></textarea>
<p class="limit">Char limit: 3000 chars.</p>
</p>
然后它会转到应该存储数据的 preview.php。
<?php
include "mysqli.connect.php";
include "fbmain.php";
$sql = "INSERT INTO table(teacherName, title, doneBy, studentClass, school, message)VALUES ('$_POST[name]','$_POST[title]','$_POST[done]','$_POST[class]','$_POST[comments]') where facebookId = '".$me['id']."'";
【问题讨论】:
-
从插入查询中移除 where 条件
-
例如'{$_POST['name']}' 但请参阅 sql 注入和准备好的语句 - 哦,那也是
-
由于SQL注入stackoverflow.com/questions/332365/…直接在sql中使用$_POST[name]时要非常小心@
-
试过'{$_POST['name']}',但不起作用。我并不担心 SQL 注入。