Question

我正在尝试将数据插入到表中，而我正在使用mysqli API执行查询。

$insert = "INSERT INTO pdhp_patient 
                   (username, password, email, first_name,     
                    last_name, dob, gender, s_s_n, i_n) 
            VALUES ('$username', '$password', '$email', '$first_name', 
                    '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";

这是我试图执行的查询。

mysqli_query($connection, $insert);

前一行代码用于执行查询。这次查询返回false。我无法理解错误是什么我甚至尝试过没有查询中的单引号。然而，这不起作用。

Editted：

$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$dob = $_POST['dob'];
$dob = date("m-d-Y", strtotime($dob));
$gender = $_POST['gender'];
$cid = $_POST['country'];
$sid = $_POST['city'];
$s_s_n = $_POST['s_s_n'];
$i_n = $_POST['i_n'];

global $connection;




if(isset($_POST['type']) && $_POST['type']==="patient"){
    $insert = "INSERT INTO pdhp_patient (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ('$username', '$password', '$email', '$first_name', '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";

    $insert = mysql_prep($insert);

        $result = mysqli_query($connection, $insert); 
if ( $result === false ) {
echo mysqli_error($connection);
exit;
}
        if($val){
        echo "This must be working";
    }else{
        echo "This was not working";
    }
}elseif(isset($_POST['type']) && $_POST['type']==="doctor"){
    $insert = "INSERT INTO pdhp_doctor (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ($username, $password, $email, $first_name, $last_name, $dob, $gender, $s_s_n, $i_n);";
    $insert = mysql_prep($insert);
    mysqli_query($connection, $insert);
}elseif(isset($_POST['environment_radio']) && $_POST['type']==="environment"){
    $insert = "INSERT INTO pdhp_environmentalist (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ($username, $password, $email, $first_name, $last_name, $dob, $gender, $s_s_n, $i_n);";
    $insert = mysql_prep($insert);
    mysqli_query($connection, $insert);
}

更多适当信息的代码。这个代码块是我想要实现的。这是完整的代码。感谢。

Answer 1

给一个人一条鱼，他今天吃。教一个人钓鱼，他每天都吃。

添加一些错误检查

$insert = "INSERT INTO pdhp_patient 
                   (username, password, email, first_name,     
                    last_name, dob, gender, s_s_n, i_n) 
            VALUES ('$username', '$password', '$email', '$first_name', 
                    '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";


$result = mysqli_query($connection, $insert); 
if ( $result === false ) {
    echo mysqli_error($connection);
    exit;
}

然后你可以修复自己的错误

Answer 2

根据您的更新和评论，您的问题是您正在逃避整个查询，而不是您传入的值。这不是转义的工作原理，通过转义逃脱它们包含的值{{1这将打破SQL封装。所以反而做..

并摆脱$username = mysqli_real_escape_string($connection, $_POST['username']); $password = mysqli_real_escape_string($connection, $_POST['password']); $email = mysqli_real_escape_string($connection, $_POST['email']); $first_name = mysqli_real_escape_string($connection, $_POST['first_name']); $last_name = mysqli_real_escape_string($connection, $_POST['last_name']); $dob = mysqli_real_escape_string($connection, $_POST['dob']); $dob = mysqli_real_escape_string($connection, date("m-d-Y", strtotime($dob))); $gender = mysqli_real_escape_string($connection, $_POST['gender']); $cid = mysqli_real_escape_string($connection, $_POST['country']); $sid = mysqli_real_escape_string($connection, $_POST['city']); $s_s_n = mysqli_real_escape_string($connection, $_POST['s_s_n']); $i_n = mysqli_real_escape_string($connection, $_POST['i_n']);。您可能应该阅读有关SQL注入的更多信息：

http://php.net/manual/en/security.database.sql-injection.php
https://www.owasp.org/index.php/SQL_Injection

更安全的方法是使用带有预准备语句的参数化查询。

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

INSERT查询在php中使用mysql返回false。使用msqli_query（$ dbcon，query）

2 个答案: