Question

我正在尝试保存存储在SQL中的信息，但此错误不断出现：“保存数据时出错。您的SQL语法出错了;请查看与您的MySQL服务器版本对应的手册在'company ='GlobalTop Inc.'附近使用的正确语法其中regid = 1'在第6行“似乎是错误？

以下是完整代码：

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>

<?php
include "db.php";
$gresult = ''; //declare global variable



//Start of edit contact read
if(isset($_POST["action"]) and $_POST["action"]=="edit"){
            $id = (isset($_POST["ci"])? $_POST["ci"] : '');
            $sql = "select regid, regname,
                            address, phone,
                            email,company from tblregistrants
                            where regid = $id";

            $result = mysqli_query($link, $sql);

            if(!$result)
            {
                echo mysqli_error($link);
                exit();
            }

            $gresult = mysqli_fetch_array($result);

            include 'update.php';
            exit();
}
//Insert or Update contact information
if(isset($_POST['action_type']))
{
        if ($_POST['action_type'] == 'add' or $_POST['action_type'] == 'edit')
        {
                //Sanitize the data and assign to variables
                $regid = mysqli_real_escape_string($link, strip_tags($_POST['regid']));
                $regname = mysqli_real_escape_string($link, strip_tags($_POST['regname']));
                $phone = mysqli_real_escape_string($link, strip_tags($_POST['phone']));
                $address = mysqli_real_escape_string($link, strip_tags($_POST['address']));         
                $email = mysqli_real_escape_string($link, strip_tags($_POST['email']));
                $company = mysqli_real_escape_string($link, strip_tags($_POST['company']));

                if ($_POST['action_type'] == 'add')
                {
                    $sql = "insert into tblregistrants set
                                        name = '$regname',
                                        phone = '$phone',
                                        address = '$address',
                                        email = '$email'
                                        company = '$company'";
                }else{
                    $sql = "update tblregistrants set
                                        name = '$regname',
                                        phone = '$phone',
                                        address = '$address',
                                        email = '$email'
                                        company = '$company'
                                        where regid = $regid";
}


        if (!mysqli_query($link, $sql))
        {
            echo 'Error Saving Data. ' . mysqli_error($link);
            exit();
        }
    }
    header('Location: view.php');
    exit();
}

//Read registrants information from database : Stage 1
$sql = "select * from tblregistrants";

$result = mysqli_query($link, $sql);

if(!$result)
{
    echo mysqli_error($link);
    exit();
}
//Loop through each row on array and store the data to $reg_list[] : Stage 2
while($rows = mysqli_fetch_array($result))
{
    $reg_list[] = array('regid' => $rows['regid'],
    'regname' => $rows['regname'],
    'address' => $rows['address'],
    'phone' => $rows['phone'],
    'email' => $rows['email'],
    'company' => $rows['company']);
}
include 'view.php';
exit();

?>

Answer 1

在,

之后的if和else语句中，您错过了email = '$email'

 if ($_POST['action_type'] == 'add')
                {
                    $sql = "insert into tblregistrants set
                                        name = '$regname',
                                        phone = '$phone',
                                        address = '$address',
                                        email = '$email', 
                                        company = '$company'";
                }else{
                    $sql = "update tblregistrants set
                                        name = '$regname',
                                        phone = '$phone',
                                        address = '$address',
                                        email = '$email',
                                        company = '$company'
                                        where regid = $regid";
}

还可以使用预备语句来防止SQL注入

Answer 2

劳伦斯建议你遗失，在你的查询上试试这个：

$sql = "insert into tblregistrants set
                                    name = '$regname',
                                    phone = '$phone',
                                    address = '$address',
                                    email = '$email',
                                    company = '$company'";

Answer 3

改变这一点，

                      $sql = "update tblregistrants set
                                        name = '$regname',
                                        phone = '$phone',
                                        address = '$address',
                                        email = '$email',
                                        company = '$company'
                                        where regid = $regid";

到此

                            $sql = "update tblregistrants set
                                            name = '$regname',
                                            phone = '$phone',
                                            address = '$address',
                                            email = '$email',
                                            company = '$company'
                                            where regid = '$regid'";

试图保存用户信息，错误

3 个答案: