Question

尝试将代码输入sqldatabase ...我在这里缺少什么？解析错误：语法错误，意外T_OBJECT_OPERATOR

<?php
$name = "";
$email = "";
$msg_to_user = "";
if ($_POST['name'] != "") {

    require_once("storescripts/connect_to_mysqli.php");

    // Be sure to filter this data to deter SQL injection, filter before querying database
    $name = $_POST['name'];
    $email = $_POST['email'];
    $sqlCommand = "SELECT * FROM newsletter WHERE email='$email'";
    $sql = mysqli_query($myConnection,$sqlCommand);
    $numRows = mysqli_num_rows($sql);
        if (!$email) {

        $msg_to_user = '<br /><br /><h4><font color="FF0000">Please type an email address ' . $name . '.</font></h4>';
    } else if ($numRows > 0) {
        $msg_to_user = '<br /><br /><h4><font color="FF0000">' . $email . ' is already in the system.</font></h4>';

    } else {
        $sqlCommand="INSERT INTO newsletter (name, email, dateTime)                                                     VALUES(?,?,NOW() )";
$stmt= $myConnection->prepare($sqlCommand);
$stmt=->bind_param('ss',$name,$email);
$stmt->execute();
    $msg_to_user = '<br /><br /><h4><font color="0066FF">Thanks ' . $name . ', you have been added successfully.</font></h4>';
        $name = "";
        $email = "";
    }
}
?>

Answer 1

您有以下代码：

$stmt=->bind_param('ss',$name,$email);

应该是这样的：

$stmt->bind_param('ss',$name,$email);

进一步（无关）的建议：

使用参数化查询修复SQL注入漏洞。请参阅How can I prevent SQL injection in PHP?
正确且一致地缩进代码以防止不可读性。

尝试将数据插入mySQL数据时T_OBJECT_OPERATOR

1 个答案: