数据未插入数据库

Question

所以我有我的表单,将数据发送到我的php文件,然后将其输入数据库.这是php后端部分

<?php
 $db = new mysqli('localhost','root','x','app');
 $username = $_POST['username'];

 $db->query("INSERT INTO people (first_name) VALUES ('{$username}'");

?>

但我的问题是,为什么不username被放入数据库？

Answer 1

您缺少)以下行中的括号:

("INSERT INTO people (first_name) VALUES ('{$username}' ")
                                                       ^ // <= right there

将其更改为:

("INSERT INTO people (first_name) VALUES ('{$username}')")

然而,正如评论中指出的那样,在使用现有方法时,您可以使用SQL注入.

• 使用预准备语句或PDO.

下面是一个准备好的声明示例:

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

$mysqli = @mysqli_connect('localhost', 'xxx', 'xxx', 'my_db');

if (!$mysqli) {
    die('Connect Error: ' . mysqli_connect_error());
}

// $username = $_POST['username'];
$username = mysqli_real_escape_string($mysqli,$_POST['username']);

   $sql = ("INSERT INTO people (first_name) VALUES (?)");

    $stmt = $mysqli->prepare($sql) or die("Failed Execution");
    $stmt->bind_param('s', $username);

    $stmt->execute();
    echo $stmt->error;

echo "SUCCESS";

    exit();

此外,在上线之前使用错误报告很重要.

• http://www.php.net/mysqli_error

如果你想进入学习PDO,

以下是一些可供您研究的教程:

• PDO教程之一
• PDO教程二
• PDO教程三

这是一个PDO示例:

<?php

    $mysql_hostname = 'xxx';
    $mysql_username = 'xxx';
    $mysql_password = 'xxx';
    $mysql_dbname = 'xxx';

    try{

    $db= new PDO("mysql:host=$mysql_hostname;dbname=$mysql_dbname", $mysql_username, $mysql_password); 

$email = $_POST['email'];
$username = $_POST['username'];

$result_set = $db->prepare("INSERT INTO `yourTable` (`email`, `username`) 

 VALUES (:email, :username)");

$result_set->bindParam(1, $email);
$result_set->bindParam(2, $username);

$result_set->execute(array(':email' => $email, ':username' => $username));

    echo "Data successfully written.";

        return $db;
    }catch(PDOException $e){
        echo $e;
        return false;
    }

?>

PDO错误处理链接:

• http://www.php.net/manual/en/pdo.error-handling.php
• http://www.php.net/manual/en/pdo.errorinfo.php