Question

我创建了一个表单但是php帖子页面没有将表单发布到数据库。

我不确定代码有什么问题..

<?php
// Create connection
$conn = mysqli_connect("localhost", "username", "password", "database");
if(isset($_POST['submit']))
{
$file = rand(1000,100000)."-".$_FILES['file']['name'];
$file_loc = $_FILES['file']['tmp_name'];
$file_size = $_FILES['file']['size'];
$file_type = $_FILES['file']['type'];
$folder="uploads/";
 move_uploaded_file($file_loc,$folder.$file);
 mysqli_query($conn,"INSERT INTO claim_info (
 claimant_name,
 claimant_surname,
 file,
 size,
 type,
 claimant_title,
 claimant_position,
 claimant_dob,
 claimant_ni

 ) VALUES (

 '$_POST[claimant_name]',
 '$_POST[claimant_surname]',
 '$file',
 '$file_size',
 '$file_type',
 '$_POST[claimant_title]',
 '$_POST[claimant_position]',
 '$_POST[claimant_dob]')");

 if (mysqli_query) {
   echo "success!";
 }
mysqli_close($conn);
}
?>

创建的表单如下：

<head>
<meta charset="UTF-8">
<title>Claim Form</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
<title>Accident Claim - Form</title>
<style>
</style>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
</head>
<body>
<div class="container">
<form method="post" action="test.php"  enctype="multipart/form-data">
<div id="stage1" class="form-group">
    <h1>Claiment Detials</h1>
    <label for="claimant_title">Title:</label>
    <select class="form-control" id="claimant_title" name="claimant_title">
        <option value=""></option>
        <option value="Mr">Mr</option>
        <option value="Ms">Ms</option>
        <option value="Mrs">Mrs</option>
        <option value="Miss">Miss</option>
    </select><br />
    <label for="claimant_position">Position: </label>
    <select class="form-control" id="claimant_position" name="claimant_position">
        <option value=""></option>
        <option value="Driver">Driver</option>
        <option value="Passenger">Passenger</option>
    </select><br />
    <label for="claimant_name">Name:</label>
    <input class="form-control" id="claimant_name" name="claimant_name" /><br />
    <label for="claimant_surname">Surname:</label>
    <input class="form-control" id="claimant_surname" name="claimant_surname" /><br />
    <label for="claimant_dob">DOB:</label>
    <input class="form-control" id="claimant_dob" name="claimant_dob" placeholder="DD/MM/YYYY" /><br />
    <label for="claimant_ni">N.I.:</label>
     <input class="form-control" id="claimant_ni" name="claimant_ni" /><br />
    <label for="claimant_address">Address:</label>
    <input class="form-control" id="claimant_address" name="claimant_address" /><br />
    <label for="claimant_postcode">Post Code:</label> <input class="form-control" id="claimant_postcode" name="claimant_postcode" /><br />
    <label for="phone">Phone:</label>
    <input class="form-control" id="claimant_phone" name="pclaimant_hone" /><br />
   <label for="email">Email:</label>
   <input class="form-control" id="claimant_email" name="claimant_email" /><br />
   <label for="file">File:</label>
   <input class="form-control" id="file" name="file" type="file"><br />
   <span id="error-message1"></span><br />
    <button class="btn btn-default" type="submit">Submit</button>
 </div>
</form>
</div>
</body>
</html>

任何人都可以指导我解决这个问题吗？提交一个空白页面时，我没有收到任何错误。

Answer 1

首先，这不起作用，因为此查询为空，因此“成功！”不会回应。

if (mysqli_query) {
    echo "success!";
}

要检查它是否成功，您应该将实际查询放在if语句中。

此外，您应该使用反向标记`来附加数据库和表名，以防止MySQL语法错误。（致@Refilon指出）

// shortened for ease to view

$query = mysqli_query($conn,"INSERT INTO `claim_info` (`claimant_name`, `claimant_surname`) VALUES ('$_POST[claimant_name]', '$_POST[claimant_surname]')");

if ($query) echo "Query Successful!";

其次，您应该使用mysqli_real_escape_string()阻止MySQL注入：

$claimant_name = mysqli_real_escape_string($conn, $_POST[claimant_name]);
$claimant_surname = mysqli_real_escape_string($conn, $_POST[claimant_surname]);

$query = mysqli_query($conn,"INSERT INTO `claim_info` (`claimant_name`, `claimant_surname`) VALUES ('$claimant_name', '$claimant_surname')");

Answer 2

更改行：

mysqli_query($conn,"[...]");

成：

$result = mysqli_query($conn,"[...]");

然后检查：

if ($result) {
  echo "success!";
}

由于：

返回值

失败时返回FALSE。成功的SELECT，SHOW，DESCRIBE或   EXPLAIN查询mysqli_query（）将返回一个mysqli_result对象。对于   其他成功的查询mysqli_query（）将返回TRUE。   Source

Answer 3

您应该在将参数直接放入数据库之前绑定参数。否则你可以得到一个SQL注入。例如：

$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");
$stmt->bind_param('sssd', $code, $language, $official, $percent);

请参阅此网站以获取完整示例： http://www.mustbebuilt.co.uk/php/insert-update-and-delete-with-mysqli/

PHP表单未提交到数据库

3 个答案: