SQL数据注入错误[注意:数组转换为字符串...]

时间:2016-12-04 15:56:52

标签: php mysql arrays string

    <?php
include '../connectdb.php';


$sqlNAME = 'INSERT INTO group_general (group_name)
VALUES (?)';

if($statementNAME = $connect->prepare($sqlNAME)) {

    $statementNAME->bind_param(

        "s",
        $_POST['groupName']
        );


/* Insert group name into DB */
    if ($statementNAME->execute()) {

        echo "Success";

    }
     else {
    echo "Failed";
}
}

$groupName = $_POST['groupName'];

$selectGROUPID = 'SELECT * FROM group_general WHERE group_name = "'.$groupName.'"';

$resultGROUPID = $connect->query($selectGROUPID);


if ($resultGROUPID->num_rows > 0) {
    $rowGROUPID = $resultGROUPID->fetch_assoc();
}

/ *对于选中并放入数组的每个用户,将它们插入到DB中并与组ID * /

组合
for ($x=0; $x<sizeof($_POST['addedUsers']); $x++) { 
    $rowUSERS[$x] = $_POST['addedUsers'][$x];

    $sqlUSERS = 'INSERT INTO group_users (user_name, group_id)
    VALUES ("'.$rowUSERS[$x].'", "'.$rowGROUPID.'")';
}
?>

我不明白我做错了什么。最后它说“在......中进行数组到字符串转换”,而我将一个数组值插入到数据库中。你能帮我吗?

0 个答案:

没有答案