这是使用PHP将数据从(HTML)表单保存到MySQL数据库的规范问题和答案.
如果您尝试执行以下操作,这适用于您:
过去提出的类似问题的示例不应使用:
连接PHP代码并将表单提交到mySQL数据库
使用php/html表单插入mysql - 不工作
如何使用PHP将HTML表单数据传递给MYSQL数据库并将数据返回到浏览器
将表单数据保存到数据库
简而言之,如果您有疑问,请继续阅读:我想使用HTML表单,PHP和MySQL或类似的方式将用户输入存储到数据库.
首先,您的PHP或HTML页面应该生成一个用户可以与之交互的表单.在最简单的形式,它是这样的:
<html>
<body>
<form method="post" action="yourscript.php">
<input type="text" name="yourfield">
<input type="submit" name="youraction" value="save">
</form>
</body>
</html>
这将为您的用户提供一个简单的表单,其中包含单个输入字段和"保存"按钮.单击"保存"按钮后,内容将使用POST方法发送到"yourscript.php" .
yourscript.php 应该实现以下内容:
以最简单的形式,这将是:
<!doctype html>
<html>
<head>
<title>Process and store</title>
</head>
<body>
<?php
// Check that user sent some data to begin with.
if (isset($_REQUEST['yourfield'])) {
/* Sanitize input. Trust *nothing* sent by the client.
* When possible use whitelisting, only allow characters that you know
* are needed. If username must contain only alphanumeric characters,
* without puntation, then you should not accept anything else.
* For more details, see: https://stackoverflow.com/a/10094315
*/
$yourfield=preg_replace('/[^a-zA-Z0-9\ ]/','',$_REQUEST['yourfield']);
/* Escape your input: use htmlspecialchars to avoid most obvious XSS attacks.
* Note: Your application may still be vulnerable to XSS if you use $yourfield
* in an attribute without proper quoting.
* For more details, see: https://stackoverflow.com/a/130323
*/
$yourfield=htmlspecialchars($yourfield);
} else {
die('User did not send any data to be saved!');
}
// Define MySQL connection and credentials
$pdo_dsn='mysql:dbname=yourdatabase;host=databasehost.example.com';
$pdo_user='yourdatabaseuser';
$pdo_password='yourdatabaspassword';
try {
// Establish connection to database
$conn = new PDO($pdo_dsn, $pdo_user, $pdo_password);
// Throw exceptions in case of error.
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// Use prepared statements to mitigate SQL injection attacks.
// See https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php for more details
$qry=$conn->prepare('INSERT INTO yourtable (yourcolumn) VALUES (:yourvalue)');
// Execute the prepared statement using user supplied data.
$qry->execute(Array(":yourvalue" => $yourfield));
} catch (PDOException $e) {
echo 'Error: ' . $e->getMessage() . " file: " . $e->getFile() . " line: " . $e->getLine();
exit;
}
?>
<form method="post">
<!-- Please note that the quotes around next <?php ... ?> block are important
to avoid XSS issues with poorly escaped user input. For more details:
https://stackoverflow.com/a/2894530
-->
<input type="text" name="yourfield" value="<?php print $yourfield; ?>">
<input type="submit" name="youraction" value="save">
</form>
</body>
</html>
这里的关键点是使用预准备语句来避免SQL注入攻击.
| 归档时间： |
|
| 查看次数： |
22801 次 |
| 最近记录： |