数据库插入错误

Question

以下回声声明，

$statement = "INSERT INTO $tbl_name VALUES(" . $_GET['username'] . "," . $_GET['password'] . "," . $_GET['PasswordHintQuestion'] . "," . $_GET['PasswordHintAnswer'] . "," . $_GET['firstname'] . "," . $_GET['lastname'] . "," . $_GET['genderSelect'] . "," . $_GET['date_in_format'] . "," . $_GET['nationality'] . "," . $_GET['refEmail'] . ")" ;   
echo $statement;

将输出视为，

INSERT INTO ge_user_table VALUES([object HTMLInputElement],[object HTMLInputElement],[object HTMLInputElement],[object HTMLInputElement],[object HTMLInputElement],[object HTMLInputElement],[object NodeList],[object HTMLSelectElement]/[object HTMLSelectElement]/[object HTMLSelectElement],[object HTMLInputElement],[object HTMLInputElement])Database Insertion fault on registration

但是在插入数据库期间我得到了错误，

  

您的SQL语法有错误;检查手册   对应于您的MySQL服务器版本，以便使用正确的语法   靠近'[object HTMLInputElement]，[object HTMLInputElement]，[object   HTMLInputElement]，第1行的[o'

但是，以下查询工作正常。

INSERT INTO ge_user_table VALUES('Muthu2','1234','Who are you?','Iam Indian','Muthu','Ganapathy','MALE','1991-12-21','Indian','abc@abc.com');

编辑： 我已将代码更改为，

  $username     = mysql_escape_string($_GET['username']);
  $password     = mysql_escape_string($_GET['password']);
  $hintQues     = mysql_escape_string($_GET['PasswordHintQuestion']);
  $hintAns      = mysql_escape_string($_GET['PasswordHintAnswer']);
  $firstname    = mysql_escape_string($_GET['firstname']);
  $hintQues     = mysql_escape_string($_GET['lastname']);
  $gender       = mysql_escape_string($_GET['genderSelect']);
  $date         = mysql_escape_string($_GET['date_in_format']) ;
  $nationality  = mysql_escape_string($_GET['nationality']) ;
  $email        = mysql_escape_string($_GET['refEmail']) ;



    $statement = "INSERT INTO $tbl_name VALUES('$username' ,'$password','$hintQues' ,'$hintAns','$firstname' ,'$lastname' ,".
               "'$gender' ,'$date','$nationality','$email')" ;   

但是，数据库有条目，

最终解决方案：    我在html中传递了form.username而不是form.username.value。现在搞定了。

Answer 1

看起来你在javascript中有错误。你发送html DOM Node而不是value。

此外，你应该逃避你的获取变量，如

mysql_real_escape_string($_GET['username']);

Answer 2

尝试这个

  $username     = mysql_escape_string($_GET['username']);
  $password     = mysql_escape_string($_GET['password']);
  $hintQues     = mysql_escape_string($_GET['PasswordHintQuestion']);
  $hintAns      = mysql_escape_string($_GET['PasswordHintAnswer']);
  $firstname    = mysql_escape_string($_GET['firstname']);
  $hintQues     = mysql_escape_string($_GET['lastname']);
  $gender       = mysql_escape_string($_GET['genderSelect']);
  $date         = mysql_escape_string($_GET['date_in_format']) ;
  $nationality  = mysql_escape_string($_GET['nationality']) ;
  $email        = mysql_escape_string($_GET['refEmail']) ;



  $statement = "INSERT INTO $tbl_name VALUES('$username' ,'$password','$hintQues' ,'$hintAns','$firstname' ,'$lastname' ,".
               "'$gender' ,'$date','$nationality','$email')" ;   

  echo $statement;

总是尽量保持语句尽可能可读..也可以在需要插入字符串的时候..它应该是引用的引用也总是使用mysql_escape_string（）来避免sql注入。

• 可能的问题可能是..你传递的是html元素而不是它的值

Answer 3

您的sql语法错误，您可以使用mysql_real_escape_string，但您还需要关心如何将值传递给sql。

在上面的查询中，你通过了没有引号的文本。

$statement = "INSERT INTO $tbl_name VALUES('".$_GET['username']."', '".$_GET['password']."', '".$_GET['PasswordHintQuestion']."', '".$_GET['PasswordHintAnswer']."', '".$_GET['firstname']."', '".$_GET['lastname']."', '".$_GET['genderSelect']."', '".$_GET['date_in_format']."', '".$_GET['nationality']."', '".$_GET['refEmail']."')" ;