Question

我正在学习PHP和MySQL。我正在尝试一个简单的页面，我可以提交一条短信，并从服务器检索一条消息（这个特定情况只是一个随机数）。

<?php

$success = false;

require_once '../../../phpIncludes/mysqlIncludes.php';
require_once '../../../phpIncludes/iphandler.php';
$creds = new MySQLLoginCredentials;
$con = $creds->ConnectToDB();

mysql_select_db("testDB", $con);

$userMsg = trim($_POST['msg']);
//The simple version for 128 Characters from the beginning of the string
$userMsg = substr($userMsg,0,128);
$userMsg = filter_var($userMsg, FILTER_SANITIZE_STRING,!FILTER_FLAG_STRIP_LOW);

$ip = encode_ip( $_SERVER['REMOTE_ADDR'] );

$time = time();

$returnMsg = "". rand() . "";

$userAgent = mysql_real_escape_string($_SERVER['HTTP_USER_AGENT']);
//Trim to 256 since that is largest db can hold
$userAgent = substr($userAgent,0,256);
$userAgent = filter_var($userAgent, FILTER_SANITIZE_STRING);

//Debug 
echo "Time : " . $time . "<br>"
. " IP: " . $ip . " | " . decode_ip($ip) . "<br>"
. " UserAgent: " . $userAgent . "<br>"
. " Msg: " . $userMsg . "<br>"
. " Return: " . $returnMsg . "<br>";

$sql = "INSERT INTO TestMessageTbl (TimeStamp, IPAddress, ClientInfo, IncMsg, OutMsg)
VALUES ('" . $time . "', " . $ip . ", " . $userAgent . ", " . $userMsg . ", " . $returnMsg .")";

$success = mysql_query($sql, $con);

if($success == false)
{
    echo "Error: " . mysql_error();
}

echo $returnMsg;

mysql_close($con);
?>

输出结果为：

<i>Time : 1356919336
IP: * | *
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko)     Chrome/23.0.1271.97 Safari/537.11
Msg: 
Return: 743166102
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.' at line 2743166102</i>

表格如下：

UID bigint(20) unsigned, AUTO_INCREMENT
TimeStamp bigint(20) unsigned
IPAddress varchar(32) utf8_general_ci
ClientInfo varchar(256) utf8_general_ci
IncMsg varchar(128) utf8_general_ci
OutMsg varchar(128) utf8_general_ci

我从mysql手动转录，包含错别字......

令我印象深刻的是奇怪的是错误的非常大的行号。怎么了？

P.S。我知道现在，$ msg将是空白的

Answer 1

使用简单的引用

包装所有值

$sql = "INSERT INTO TestMessageTbl (TimeStamp, IPAddress, ClientInfo, IncMsg, OutMsg)
VALUES ('" . $time . "', '" . $ip . "', '" . $userAgent . "', '" . $userMsg . "', '" . $returnMsg ."')";

这个PHP和/或MySQL查询有什么问题？

1 个答案: