Question

我之前发布了一个类似的问题..但是现在代码存在问题......数据已进入MySql数据库......

PHP文件：

<html>

<head>
  <title>Enter New Project Details</title>
</head>

<body>
<?php include 'RegProj.html';

$pn=isset($_POST['ProjectName']) ? $_POST['ProjectName'] : '';
$tn=isset($_POST['TaskName']) ? $_POST['TaskName'] : ''; 
$dsc=isset($_POST['Proj_desc']) ? $_POST['Proj_desc'] : ''; 
$date = date('Y-m-d H:i:s');
$serverName = "Swagatha-PC"; 
if($_SERVER['REQUEST_METHOD']=="POST")
{

$conn = mysqli_connect( 'localhost:3307', 'root', '', 'TimeSheet');

if( $conn ) 
{
 echo "Connection established.<br />";
}
else
{
 echo "Connection could not be established.<br />";
 die( print_r( mysqli_connect_errno($conn), true));
} 

$query="Insert Into dbo.Project (DateAdded,ProjectName,TaskName,Proj_desc) 
values ('$date','$pn' ,'$tn' , '$dsc')";
$stmt=mysqli_query($conn,$query);


if($stmt==false)
{
echo "Error in adding Info!! Reload Page and try again!!<br/>";
 die( print_r( mysqli_connect_errno($stmt), true));
}
else
{
 echo " Record Added!!";
}
mysqli_close($conn);

}
?>
</body>
</html>

HTML文件：

    <html>

   <head>
      <title>Enter New Project Details</title>    
    </head>

<body>
 <form id="project" method = "post" action = "RPMS.php">
         <table>
            <tr>
               <td>Project Name:</td> 
               <td><input type = "text" name = "ProjectName"></td>
            </tr>

            <tr>
               <td>Task Name:</td>
               <td><input type = "text" name = "TaskName"></td>
            </tr>

            <tr>
               <td>Project description:</td>
               <td><textarea name = "Proj_desc" rows = "5" cols = "40"></textarea></td>
            </tr>

            <tr>
               <td>
                  <input type = "submit" name = "submit" value = "Submit" > 
               </td>
            </tr>
         </table>
      </form>

</body>
</html>

错误看起来像这样：

我该如何解决？

Answer 1

您必须更改数据库名称

这

$query="Insert Into dbo.Project (DateAdded, ProjectName, TaskName, Proj_desc) values ('$date','$pn' ,'$tn' , '$dsc')";

到

$query="Insert Into TimeSheet.Project (DateAdded, ProjectName, TaskName, Proj_desc) values ('$date','$pn' ,'$tn' , '$dsc')";

Answer 2

你应该mysqli_real_escape_string所有$ _POST数据。如果任何包含单引号 - 将是sql语法错误。 SQL注入也是可能的。

PHP-无法将数据输入数据库

2 个答案: