试图保护我的SQL查询免受注入攻击并且没有任何运气

Question

我在这里阅读了几篇文章，然后逐字查询（减去我的变量名），并且我无法让我的代码在我正在工作的网站上运行而不会出现错误。我所拥有的只是用户可以上传图像的表单。

我的原始代码易受攻击，但可以正常工作：

<?php
  $uploadDir = 'images/';


  if(isset($_POST['upload']))
  {
    $fileName = $_FILES['userfile']['name'];
    $tmpName = $_FILES['userfile']['tmp_name'];
    $fileSize = $_FILES['userfile']['size'];
    $fileType = $_FILES['userfile']['type'];
    $memberID = $_POST['member-id'];
    $imgTitle = $_POST['img-title'];
    $catID = $_POST['catID'];

    $filePath = $uploadDir . $fileName;

    $result = move_uploaded_file($tmpName, $filePath);

    if (!$result) {
      echo "Error uploading file";
      exit;
     }

    echo "<br>Files uploaded<br>";

    if(mysqli_connect_errno())
     {
       printf("Connect failed: %s\n", mysqli_connect_error());
       exit();
     }

     if(!get_magic_quotes_gpc())
        {
         $fileName = addslashes($fileName);
         $filePath = addslashes($filePath);
        } 


       $query = "INSERT INTO `tblImage` (`fldImageID`, `fldMemberID`, `fldCatID`, `fldFilePath`, `fldName`) VALUES (NULL, '$memberID', '$catID', '$filePath', '$imgTitle')";

        $query = "SELECT `fldImageID` FROM `tblImage` ORDER BY `fldImageID` DESC LIMIT 1";


        $result = $conn->query($query) or die ("error");

 }

?>

，然后下面是我尝试执行准备好的语句而没有运气的地方，请有人指出我的错误是我只粘贴了下面的代码，该代码覆盖了$ query开始的上面的代码。

    $stmt = $conn->prepare = ("INSERT INTO tblImage (fldImageID, fldMemberID, fldCatID, fldFilePath, fldName) VALUES (NULL, ?, ?, ?, ?)");

    $stmt->bind_param($stmt, "ssss", $memberID, $catID, $filePath, $imgTitle); 
    mysqli_stmt_execute($stmt);
    $stmt->execute();
    $result = mysqli_stmt_get_result($stmt) or die ("error");

网页上的错误消息：

Answer 1

您具有附加的价值：

$stmt = $conn->prepare = ("INSERT INTO tblImage (fldImageID, fldMemberID, fldCatID, fldFilePath, fldName) VALUES (NULL, ?, ?, ?, ?)");

只需删除该运算符即可：

$stmt = $conn->prepare("INSERT INTO tblImage (fldImageID, fldMemberID, fldCatID, fldFilePath, fldName) VALUES (NULL, ?, ?, ?, ?)");