PHP查询失败

Question

<?php
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$dbhost = 'localhost';
$dbuser = 'zuk1_boo';
$dbpass = 'lols';
$dbname = 'zuk1_boo';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');

$name = $_POST['name'];
$iq = $_POST['iq'];

$nuname = str_replace(" ", "-", $name);
$nuname = $nuname.".gif";
$path = "img/$nuname";

move_uploaded_file($_FILES['userfile']['tmp_name'],$path);

$query = "INSERT INTO celebs (celeb,path1,iqq) VALUES ('$name','$path','$iq')";

mysql_query($query) or die('q fail');

mysql_close($conn);

echo "<br>File $fileName uploaded<br>";
}
?>

<form method="post" enctype="multipart/form-data">
<table width="350" border="0" cellpadding="1" cellspacing="1" class="box">
<tr>
<tr><td><input name="name" type="text" value="name"></td></tr>
<tr><td><input name="iq" type="text" value="iq"></td></tr>
<td width="246">
<input type="hidden" name="MAX_FILE_SIZE" value="2000000">
<input name="userfile" type="file" id="userfile">
</td>
<td width="80"><input name="upload" type="submit" class="box" id="upload" value=" Upload "></td>
</tr>
</table>
</form>

请记住,有一个自动增量的ID行,但即使我将其添加到查询中,它仍然无法正常工作.

无论我对这个查询做什么它只是不起作用,我已经三次检查sql详细信息并且它们很好,即使它似乎连接正常无论如何.我在查询中使用了字段名称,它们应该没问题,但它不会起作用!$ 5 Paypal给任何可以帮助我的人,老实说,我很沮丧,这是不真实的.

Answer 1

mysql_query($query) or die('q fail');

替换为

mysql_query($query) or die(mysql_error());

并告诉我们你得到了什么.

Answer 2

好吧,既然你已经解决了实际问题,我认为最好指出你有大量的SQL注入漏洞.

理想的修复方法是切换到使用PDO或MySQLi函数并使用参数化查询,但最快的修复方法是更改​​这些行:

$name = $_POST['name'];
$iq = $_POST['iq'];

至

$name = mysql_real_escape_string($_POST['name']);
$iq = mysql_real_escape_string($_POST['iq']);

你现在拥有的代码在公开时非常不安全.