PHP SQL - 插入表中

Question

我有一个问题亲爱的stackoverflowers,有人可以帮帮我吗？

这是我的代码:

<?php
    $host = "localhost";
    $user = "root";
    $pass = "password";
    $db   = "hotelcalifornia";

    $room_Number      = ($_POST['Room_Number']);
    $room_Category    = ($_POST['Room_Category']);
    $room_Description = ($_POST['Room_Description']);
    $room_Detail      = ($_POST['Room_Detail']);

    $conn = mysql_connect($host, $user, $pass);
    $db   = mysql_select_db($db, $conn);

    mysql_select_db($db, $conn);

    $sql = "INSERT TO room (roomNumber, roomCategory, roomDescription,roomDetail) VALUES ('$room_Number','$room_Category', '$room_Description','$room_Detail')";

    mysql_query($sql, $conn);        

?>

有人能告诉我为什么我不能将这些数据插入我的数据库表中吗？

Answer 1

它不是INSERT TO,它是.因此INSERT INTO你不应该使用mysql函数,而是使用mysqli函数,因为你的代码容易受到SQL注入攻击.

$host = "localhost";
$user = "root";
$pass = "password";
$db   = "hotelcalifornia";

$conn = new mysqli($host, $user, $pass, $db);

$room_Number      = $_POST['Room_Number'];
$room_Category    = $_POST['Room_Category'];
$room_Description = $_POST['Room_Description'];
$room_Detail      = $_POST['Room_Detail'];

$sql = "INSERT INTO room (roomNumber, roomCategory, roomDescription,roomDetail) VALUES (?,?,?,?)";
$stmt = $conn->prepare($sql);
$stmt->bind_param('iiss', $room_Number, $room_Category, $room_Description, $room_Detail);
if ($stmt->execute()) {
    if($stmt->affected_rows > 0){
        echo "New record created successfully";
    }
} else {
    echo "Error: " . $sql . "<br>" . $stmt->error;
}
$stmt->close();

在行内$stmt->bind_param('iiss', $room_Number, $room_Category, $room_Description, $room_Detail); i对应于整数,其中s对应于字符串的变量顺序,我假设$room_Number它$room_Category是整数值,其中$room_Description和$room_Detail是字符串值.