Question

我有一个非常简单的代码将数据插入数据库，还检查表中是否已有相同的数据

[HTML]

<html>
<head>
    <title>nickname</title>
</head>
<body>
    <p>input nickname</p>
    <form action="foo.php" method="post">
        <input type="text" name="nickname" />
        <input type="submit">
    </form>
</body>
</html>

的 [PHP] 。

//foo.php
if(isset($_POST['nickname']) && !empty($_POST['nickname'])) {
    $nickname = $_POST['nickname'];

    //Object Oriented way
    $servername = "localhost";
    $username = "root";
    $password = "foo_bar";
    $dbname = "nickname";

    //check connection
    $conn = new mysqli($servername, $username, $password, $dbname);

    if($conn->connect_error) {
        die("cannot connect:".$conn->connect_error);
    }

    $sql = "SELECT * FROM nickname WHERE nickname='$nickname'";
    $result = $conn->query($sql);

    if($result->num_rows > 0) {
        echo "nickname exists!";
    } else {
        $sql = "INSERT INTO nickname(nickname) VALUES(".$nickname.")";
        $conn->query($sql);
        echo "welcome $nickname!";
    }

    $conn->close();

} else {
    echo "please input your nickname";
}

我还在学习如何使用MySQL，我做错了什么？特别是这一行

$sql = "INSERT INTO nickname(nickname) VALUES(".$nickname.")";
$conn->query($sql);

变量中的数据未插入表中，没有任何反应。但如果我将$nickname替换为纯文本，则会插入数据。

修改
为什么这是重复的？问题甚至不是“如何防止SQL注入”

Answer 1

为变量

提供单引号

$sql = "INSERT INTO nickname(nickname) VALUES('".$nickname."')";
$conn->query($sql);

变量未插入表

1 个答案: