Question

我需要一些我无法解决的基本问题的帮助。一点背景：我有一个PHP表单，我希望表中的信息插入到我的SQL表中。出于某种原因，当我点击提交时，没有任何内容插入到表中，我不知道为什么。请帮忙！这是PHP代码：

<?php 
try
    {
        $db = new PDO('mysql:host=' . $Database_Host . ';dbname=' . $Database_Database, $Database_Username, $Database_Password);
    }catch(PDOException $e){
        die("Failed to connect to database! Please check the database settings.");
    }
if(isset($_POST['submit'])) {  
     $result = mysql_query('INSERT INTO requests (song,name,dedicated,time) VALUES ("' . mysql_real_escape_string($_POST['name']) . '", "' . mysql_real_escape_string($_POST['dedicated']) . '", "' . mysql_real_escape_string($_POST['song']) . '", UNIX_TIMESTAMP())'); 
    if ($result) { 
        echo 'Song requested successfully!<br />'; 
    } 
} 
?>

这是HTML代码：

<form method="POST" action="<?php echo $_SERVER['PHP_SELF']; ?>">Request:<br /><br /> 
Song:<br /> 
<input type="text" name="song"><br /> 
Name:<br /> 
<input type="text" name="name"><br /> 
Comments:<br /> 
<input type="text" name="dedicated"><br /> 
<input type="submit" name="submit" value="Submit" >
</form>

这意味着将请求表单插入SQL表中，但不会发生任何事情。任何帮助表示赞赏。

亲切的问候，爱德华

Answer 1

你不能把mysql和PDO混在一起。您应该为插入使用PDO准备的查询。

此外，VALUES列表中的值的顺序必须与列列表匹配 - 您的值为name, dedicated, song, time而不是song, name, dedicated, time。

<?php 
if (isset($_POST['submit'])) {
    try
    {
        $db = new PDO('mysql:host=' . $Database_Host . ';dbname=' . $Database_Database, $Database_Username, $Database_Password);
    }catch(PDOException $e){
        die("Failed to connect to database! Please check the database settings.");
    }
    $stmt = $db->prepare('INSERT INTO requests (song,name,dedicated,time) VALUES (:song, :name, :dedicated, UNIX_TIMESTAMP())'); 
    $result = $stmt->execute(array(':song' => $_POST['song'], ':name' => $_POST['name'], ':dedicated' => $_POST['dedicated']));
    if ($stmt->rowCount == 1) {
        echo "Song requested successfully";
    } else {
        echo "Song could not be requested";
    }
}

Answer 2

您应该研究pdo和mysql，然后使用它们...... 用mysql看这个简单的例子：

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// prepare and bind
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);

// set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();

$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";
$stmt->execute();

$firstname = "Julie";
$lastname = "Dooley";
$email = "julie@example.com";
$stmt->execute();

echo "New records created successfully";
$stmt->close();
$conn->close();
?>

这个与pdo：

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDBPDO";

try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// prepare sql and bind parameters
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email)
VALUES (:firstname, :lastname, :email)");
$stmt->bindParam(':firstname', $firstname);
$stmt->bindParam(':lastname', $lastname);
$stmt->bindParam(':email', $email);

// insert a row
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();

// insert another row
$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";
$stmt->execute();

// insert another row
$firstname = "Julie";
$lastname = "Dooley";
$email = "julie@example.com";
$stmt->execute();

echo "New records created successfully";
}
catch(PDOException $e)
{
echo "Error: " . $e->getMessage();
}
$conn = null;
?>

我更喜欢使用pdo

来源：http://www.w3schools.com/php/php_mysql_prepared_statements.asp

注意：使用预准备语句来避免sql注入。

简单的PHP表单SQL插入

2 个答案: