Question

我的代码是。

$newModel = "INSERT INTO models (id," . 
    " firstname," .
    " lastname," .
    " email," .
    " password," .
    " group," .
    " phone," .
    " timeofday," .
    " dayofweek," .
    " address," .
    " city," .
    " state," .
    " zip," .
    " gender," .
    " hair," .
    " eye," .
    " birthday," .
    " birthmonth," .
    " birthyear," .
    " bustshirt," .
    " cup," .
    " waist," .
    " hips," .
    " waist," .
    " hips," .
    " weight," .
    " inches," .
    " dressjacket," .
    " workxp," .
    " twitter," .
    " facebook," .
    " joindate," .
    " instagram," .
    " imdb," .
    " parentid," .
    " error) VALUES (".
    PrepSQL($modelid) . ", " .
    PrepSQL($firstname) . ", " .
    PrepSQL($lastname) . ", " .
    PrepSQL($email) . ", " .
    PrepSQL($password) . ", " .
    PrepSQL($group) . ", " .
    PrepSQL($phone) . ", " .
    PrepSQL($timeofday) . ", " .
    PrepSQL($dayofweek) . ", " .
    PrepSQL($address) . ", " .
    PrepSQL($city) . ", " .
    PrepSQL($state) . ", " .
    PrepSQL($zip) . ", " .
    PrepSQL($gender) . ", " .
    PrepSQL($hair) . ", " .
    PrepSQL($eyes) . ", " .
    PrepSQL($bday) . ", " .
    PrepSQL($bmonth) . ", " .
    PrepSQL($byear) . ", " .
    PrepSQL($bust) . ", " .
    PrepSQL($cup) . ", " .
    PrepSQL($waist) . ", " .
    PrepSQL($hips) . ", " .
    PrepSQL($weight) . ", " .
    PrepSQL($height) . ", " .
    PrepSQL($dressjacket) . ", " .
    PrepSQL($workxp) . ", " .
    PrepSQL($twitter) . ", " .
    PrepSQL($facebook) . ", " .
    PrepSQL($joindate) . ", " .
    PrepSQL($instagram) . ", " .
    PrepSQL($imdb) . ", " .
    PrepSQL($parentid) . ", " .
    PrepSQL($error) . ")";

mysql_query($newModel) or die(mysql_error());

发出错误：

您的SQL语法有错误;检查手册对应于您的MySQL服务器版本，以便使用正确的语法靠近'group，phone，timeofday，dayofweek，地址，城市，州，邮编，性别，头发，眼睛'在第1行

Answer 1

group是reserved word in MySQL。你必须用反引号包装它：

`group`,
phone

等

Answer 2

GROUP是保留关键字，恰好是列的名称。要避免语法错误，您需要使用反引号来转义它。例如，

`group`

MySQL Reserved Keywords List

如果您有权更改表，请将列名更改为不是保留关键字，以避免再次出现问题。

作为旁注，如果变量的值（ s ）来自外部，则查询易受SQL Injection攻击。请查看下面的文章，了解如何防止它。通过使用PreparedStatements，您可以摆脱在值周围使用单引号。

How to prevent SQL injection in PHP?

我自己的SQL语法错误

2 个答案: