PHP和MySql有问题

Question

我在制作这个看似简单的MySql查询工作时遇到了麻烦.谁能发现问题？

<?php
include "config.php";

$offerid = $_POST["offerid"];
$ip = $_SERVER["REMOTE_ADDR"];

mysql_query("INSERT INTO voted (offerid,ip) VALUES (".$offerid.",".$ip.")");
?>

Answer 1

你可能想要一些单引号:

 "INSERT INTO voted (offerid,ip) VALUES ('" . $offerid . "','" . $ip . "')"

您还应该使用intval并mysql_real_escape_string避免SQL注入漏洞:

 $sql = "INSERT INTO voted (offerid,ip) VALUES (" .
        intval($offerid). ", '" .
        mysql_real_escape_string($ip) . "')";

另一种可能更容易阅读的替代方案是使用sprintf:

 $sql = sprintf("INSERT INTO voted (offerid, ip) VALUES (%d, '%s')",
                $offerid, mysql_real_escape_string($ip));