Question

所以我正在重新编写脚本以包含预准备语句。它之前工作正常，但现在我得到“脚本运行时没有为预备语句中的参数提供数据”。这是什么问题？

<?php
require_once("models/config.php");


$firstname = htmlspecialchars(trim($_POST['firstname']));
$firstname = mysqli_real_escape_string($mysqli, $firstname);
$surname = htmlspecialchars(trim($_POST['surname']));
$surname = mysqli_real_escape_string($mysqli, $surname);
$address = htmlspecialchars(trim($_POST['address']));
$address = mysqli_real_escape_string($mysqli, $address);
$gender = htmlspecialchars(trim($_POST['gender']));
$gender = mysqli_real_escape_string($mysqli, $gender);
$city = htmlspecialchars(trim($_POST['city']));
$city = mysqli_real_escape_string($mysqli, $city);
$province = htmlspecialchars(trim($_POST['province']));
$province = mysqli_real_escape_string($mysqli, $province);
$phone = htmlspecialchars(trim($_POST['phone']));
$phone = mysqli_real_escape_string($mysqli, $phone);
$secondphone = htmlspecialchars(trim($_POST['secondphone']));
$secondphone = mysqli_real_escape_string($mysqli, $secondphone);
$postalcode = htmlspecialchars(trim($_POST['postalcode']));
$postalcode = mysqli_real_escape_string($mysqli, $postalcode);
$email = htmlspecialchars(trim($_POST['email']));
$email = mysqli_real_escape_string($mysqli, $email);
$organization = htmlspecialchars(trim($_POST['organization']));
$organization = mysqli_real_escape_string($mysqli, $organization);
$inriding = htmlspecialchars(trim($_POST['inriding']));
$inriding = mysqli_real_escape_string($mysqli, $inriding);
$ethnicity = htmlspecialchars(trim($_POST['ethnicity']));
$ethnicity = mysqli_real_escape_string($mysqli, $ethnicity);
$senior = htmlspecialchars(trim($_POST['senior']));
$senior = mysqli_real_escape_string($mysqli, $senior);
$student = htmlspecialchars(trim($_POST['student']));
$student = mysqli_real_escape_string($mysqli, $student);


$order= "INSERT INTO persons (firstname, surname, address, gender, city, province,  postalcode, phone, secondphone, email, organization, inriding, ethnicity, senior, student_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
$stmt = mysqli_prepare($mysqli, $order);
mysqli_stmt_bind_param($stmt, "sssd", $firstname, $surname, $address, $gender, $city, $province, $postalcode, $phone, $secondphone, $email, $organization, $inriding, $ethnicity, $senior, $student);
mysqli_stmt_execute($stmt); 
echo $stmt->error;

$result = mysqli_query($mysqli,$stmt);
if ($result === false) {
echo "Error entering data! <BR>";
echo mysqli_error($mysqli);
 } else {
echo "User $firstname added <BR>";
 }
?>

提前致谢。

Answer 1

你只用控制字符串＆＃34; sssd＆＃34;绑定了四个参数，但你有很多参数。使用mysqli绑定变量时，每个参数需要一个字符，例如：

mysqli_stmt_bind_param($stmt, "sssdsssssssssdd", $firstname, $surname, $address, 
    $gender, $city, $province, $postalcode, $phone, $secondphone, $email, 
    $organization, $inriding, $ethnicity, $senior, $student);

（我假设高年级和学生是整数，需要＆＃34; d＆＃34;代码。）

您不需要使用mysqli_real_escape_string（）处理任何变量 - 这是使用参数的重点。如果你也进行了转义，你将在数据库中的数据中获得字面反斜杠字符。

在任何情况下你都不需要使用htmlspecialchars（） - 在输出到HTML时使用它，而不是在插入数据库时使用。您将在数据库中的数据中获得&等文字序列。

重新下一个错误：

＆＃34;可捕获的致命错误：类mysqli_stmt的对象无法转换为...＆＃34;

这是由以下原因引起的：

$result = mysqli_query($mysqli,$stmt);

该函数期望第二个参数是一个字符串，一个新的SQL查询。但是您已经准备好了该查询，因此您需要以下内容：

$result = mysqli_stmt_execute($stmt);

“没有为准备好的声明中的参数提供数据”

1 个答案: