SQL错误 - 提交时出错 - php

时间:2017-12-09 01:23:44

标签: php mysql sql-injection

<?php
require '../../config.php';
if(isset($_POST['account_type']) && $_POST['account_type'] == 1)
{
$account_type = $_POST['account_type'];
$s_name_scoach = $_POST['s_name_scoach'];
$s_phone_coach = $_POST['s_phone_coach'];
$s_email_coach = $_POST['s_email_coach'];
$s_password_coach = encryptIt(mysqli_real_escape_string($statcash,$_POST['s_password_coach']));
$s_nameSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_nameSchool_coach']);
$s_addSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_addSchool_coach']);
$s_phoneSchool_coach = $_POST['s_phoneSchool_coach'];

收到错误讯息:
您的SQL语法有错误;查看与您的MySQL服务器版本相对应的手册,以获得正确的语法,以便在&#39;&#39;&#39;&#39;在第10行

<?php  
require '../../config.php';
if(isset($_POST['account_type']) && $_POST['account_type'] == 1)
{
$account_type = $_POST['account_type'];
$s_name_scoach = $_POST['s_name_scoach'];
$s_phone_coach = $_POST['s_phone_coach'];
$s_email_coach = $_POST['s_email_coach'];
$s_password_coach = encryptIt(mysqli_real_escape_string($statcash,$_POST    ['s_password_coach']));
$s_nameSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_nameSchool_coach']);
$s_addSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_addSchool_coach']);
$s_phoneSchool_coach = $_POST['s_phoneSchool_coach'];


$check_email = $statcash->query("SELECT * FROM users WHERE 
email = '".$s_email_coach."' AND account_type = '".$account_type."'
");

if($check_email->num_rows > 0)
{
echo "Email Address Already Exists!";
}
else
{
$add_users = $statcash->query("INSERT INTO users SET
account_type = '".$account_type."',
name = '".$s_name_scoach."',
phone = '".$s_phone_coach."',
email = '".$s_email_coach."',
password = '".$s_password_coach."',
school_name = '".$s_nameSchool_coach."',
school_address = '".$s_addSchool_coach."',
school_phone = '".$s_phoneSchool_coach."',
'
");

if($add_users)
{?>
<script>
document.location = "../index.php";
</script>
<?php
}
else
{
echo mysqli_error($statcash);
}
}
}
else if(isset($_POST['account_type']) && $_POST['account_type'] == 2)
{
$account_type = $_POST['account_type'];
$s_name_scoach = $_POST['s_name_scoach'];
$s_phone_coach = $_POST['s_phone_coach'];
$s_email_coach = $_POST['s_email_coach'];
$s_password_coach = encryptIt(mysqli_real_escape_string($statcash,$_POST['s_password_coach']));
$s_nameSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_nameSchool_coach']);
$s_addSchool_coach = mysqli_real_escape_string($statcash,$_POST['s_addSchool_coach']);
$s_phoneSchool_coach = $_POST['s_phoneSchool_coach'];

$check_email = $statcash->query("SELECT * FROM users WHERE 
email = '".$s_email_coach."' AND account_type = '".$account_type."'
");

if($check_email->num_rows > 0)
{
echo "Email Address Already Exists!";
}
else
    {
        $add_users = $statcash->query("INSERT INTO users SET
            account_type = '".$account_type."',
            name = '".$s_name_scoach."',
            phone = '".$s_phone_coach."',
            email = '".$s_email_coach."',
            password = '".$s_password_coach."',
            school_name = '".$s_nameSchool_coach."',
            school_address = '".$s_addSchool_coach."',
            school_phone = '".$s_phoneSchool_coach."',

        ");

        if($add_users)
        {?>
            <script>
                document.location = "../index.php";
            </script>
        <?php
        }
        else
        {
            echo mysqli_error($statcash);
        }
    }
}
else if(isset($_POST['account_type']) && $_POST['account_type'] == 3)
{
    $account_type = $_POST['account_type'];
    $s_name_scoach = $_POST['ass_coach_name'];
    $s_email_coach = $_POST['ass_coach_email'];

    $s_password_coach = encryptIt(mysqli_real_escape_string($statcash,$_POST['ass_coach_password']));

    $check_email = $statcash->query("SELECT * FROM users WHERE 
        email = '".$s_email_coach."' AND account_type = '".$account_type."'
    ");

    if($check_email->num_rows > 0)
    {
        echo "Email Address Already Exists!";
    }
    else
    {
        $add_users = $statcash->query("INSERT INTO users SET
            account_type = '".$account_type."',
            name = '".$s_name_scoach."',
            email = '".$s_email_coach."',
            password = '".$s_password_coach."'
        ");

        if($add_users)
        {?>
            <script>
                document.location = "../index.php";
            </script>
        <?php
        }
        else
        {
            echo mysqli_error($statcash);
        }
    }
}
else if(isset($_POST['account_type']) && $_POST['account_type'] == 4)
{
    $account_type = $_POST['account_type'];
    $s_name_scoach = $_POST['ass_coach_name'];
    $s_email_coach = $_POST['ass_coach_email'];
    $ass_coach_phone = $_POST['ass_coach_phone'];
    $s_password_coach = encryptIt(mysqli_real_escape_string($statcash,$_POST['ass_coach_password']));

    $check_email = $statcash->query("SELECT * FROM users WHERE 
        email = '".$s_email_coach."' AND account_type = '".$account_type."'
    ");

    if($check_email->num_rows > 0)
    {
        echo "Email Address Already Exists!";
    }
    else
    {
        $add_users = $statcash->query("INSERT INTO users SET
            account_type = '".$account_type."',
            name = '".$s_name_scoach."',
            email = '".$s_email_coach."',
            phone = '".$ass_coach_phone."',
            password = '".$s_password_coach."'
        ");

        if($add_users)
        {?>
            <script>
                document.location = "../index.php";
            </script>
        <?php
        }
        else
        {
            echo mysqli_error($statcash);
        }
    }
}
else
{
    echo "You Must Submit Form for Registration!";
}

&GT;

这是否涵盖了您的需求?如果你需要更多,我最终可以粘贴剩下的部分。但是,我宁愿把它保持在最低限度 - 因为我相信你也会欣赏它......

1 个答案:

答案 0 :(得分:-1)

之后删除了    school_phone ='“。$ s_phoneSchool_coach。”'

中的