VAR数据未推送到SQL


VAR data not pushing to SQL

我有一个小问题,我不知道为什么。也许有人能帮我。首先是一些免责声明;我仍在学习PHP,我知道mysqli或pdo,但它将运行的服务器是一个旧的PHP版本4。

好的,现在来讨论这个问题。

我有一个表单,它传递到我的post-data.php表单,以推送到SQL数据库。

然而,当它推送数据时,它只是推送变量,而不是表单后操作中变量中的数据

PHPmyadmin 中提交数据的屏幕截图

我的代码如下:

<?php
    $hostname = "localhost"; $username = "goldme_owner";
    $dbName = "goldme_dealer_meeting";
    $connect = mysql_connect($hostname, $username);
    if (!$connect) { 
        echo "Please try later."; 
    } 
    else { 
        mysql_select_db($dbName, $connect); 
        $checkboxA1 = isset($_POST['checkboxA1']) ? $_POST['checkboxA1'] : 'No';
        $checkboxE1 = isset($_POST['checkboxE1']) ? $_POST['checkboxE1'] : 'No';
        $checkboxF1 = isset($_POST['checkboxF1']) ? $_POST['checkboxF1'] : 'No';
        $checkboxG1 = isset($_POST['checkboxG1']) ? $_POST['checkboxG1'] : 'No';
        $checkboxH1 = isset($_POST['checkboxH1']) ? $_POST['checkboxH1'] : 'No';
        $checkboxI1 = isset($_POST['checkboxI1']) ? $_POST['checkboxI1'] : 'No';
        $checkboxJ1 = isset($_POST['checkboxJ1']) ? $_POST['checkboxJ1'] : 'No';
        $checkboxK1 = isset($_POST['checkboxK1']) ? $_POST['checkboxK1'] : 'No';
    }
    echo "$checkboxA1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxE1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxF1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxG1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxH1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxI1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxJ1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$checkboxK1"; //just want to make sure checkbox vars are passing //will delete in final code
    echo "$_POST[confirm]"; //just want to make sure confirm code generated //will delete in final code
        $sql_statement = 'INSERT INTO 2014_registrations'. 
        '(confirm_number,timecode,company_name,country,address1,address2,city'.
        ',state,zip,phone,fax,email,zone_manager,transport,first_name,'.
        'last_name,tuesday_tours,tuesday_meat,wed_lunch,wed_dinner,'.
        'wed_pool_tourney,thurs_lunch,thurs_dinner,fri_shop,fri_tour,dietary)'.
        'VALUES ("$_POST[confirm]","$_POST[timecode]","$_POST[company_name]",'.
        '"$_POST[address]","$_POST[address2]","$_POST[city]","$_POST[state]",'.
        '"$_POST[zip]","$_POST[country]","$_POST[phone]","$_POST[fax]",'.
        '"$_POST[email]","$_POST[zonemanager]","$_POST[transport]",'.
        '"$_POST[fattendee1]","$_POST[lattendee1]","$_POST[checkboxA1]",'.
        '"$_POST[radio1]","$_POST[checkboxE1]","$_POST[checkboxF1]",'.
        '"$_POST[checkboxG1]","$_POST[checkboxH1]","$_POST[checkboxI1]",'.
        '"$_POST[checkboxJ1]","$_POST[checkboxK1]","$_POST[dietary1]")';

    $rec_insert = mysql_query($sql_statement);
    if(! $rec_insert ){
        die('Could not enter data: ' . mysql_error());
    }
    echo "Entered data successfully'n";
    mysql_close($connect);
?> 

在单引号中,变量不会作为变量读取。例如,echo '$a'将打印$a,而echo "$a"将打印$a的值。

在您的代码中,您试图使用类似于'$a'的东西,或者换句话说,您在变量周围使用单引号而不是双引号。

试着把它写成

"VALUES ('$_POST[confirm]','$_POST[timecode]','$_POST[company_name]',".

'VALUES ("'.$_POST[confirm].'","'.$_POST[timecode].'","'.$_POST[company_name].'",'.

等等。

请注意,$_POST[confirm]的使用会发出通知。正确的使用方法是$_POST['confirm']

还要注意,您的代码容易受到SQL注入的攻击。考虑使用事先准备好的语句。

变量被读取为字符串,因为它们是用单引号写的。

我已经将变量移到了单引号之外,并将它们连接到字符串中此代码极易受到SQL注入的影响,不应在生产环境中使用

$sql_statement = 'INSERT INTO 2014_registrations'. 
'(confirm_number,timecode,company_name,country,address1,address2,city'.
',state,zip,phone,fax,email,zone_manager,transport,first_name,'.
'last_name,tuesday_tours,tuesday_meat,wed_lunch,wed_dinner,'.
'wed_pool_tourney,thurs_lunch,thurs_dinner,fri_shop,fri_tour,dietary)'.
'VALUES ("'.$_POST[confirm].'","'.$_POST[timecode].'","'.$_POST[company_name].'",'.
'"'.$_POST[address].'","'.$_POST[address2].'","'.$_POST[city].'","'.$_POST[state].'",'.
'"'.$_POST[zip].'","'.$_POST[country].'","'.$_POST[phone].'","'.$_POST[fax].'",'.
'"'.$_POST[email].'","'.$_POST[zonemanager].'","'.$_POST[transport].'",'.
'"'.$_POST[fattendee1].'","'.$_POST[lattendee1].'","'.$_POST[checkboxA1].'",'.
'"'.$_POST[radio1].'","'.$_POST[checkboxE1].'","'.$_POST[checkboxF1].'",'.
'"'.$_POST[checkboxG1].'","'.$_POST[checkboxH1].'","'.$_POST[checkboxI1].'",'.
'"'.$_POST[checkboxJ1].'","'.$_POST[checkboxK1].'","'.$_POST[dietary1].'")';

首先,从POST请求直接将数据插入数据库几乎不是一个好主意。

我知道它的格式真的很糟糕,但试着使用这个$sql_statement:

$sql_statement = 'INSERT INTO 2014_registrations'. 
    '(confirm_number,timecode,company_name,country,address1,address2,city'.
    ',state,zip,phone,fax,email,zone_manager,transport,first_name,'.
    'last_name,tuesday_tours,tuesday_meat,wed_lunch,wed_dinner,'.
    'wed_pool_tourney,thurs_lunch,thurs_dinner,fri_shop,fri_tour,dietary)'.
    "VALUES ('"{$_POST[confirm]}'",'"{$_POST[timecode]}'",'"{$_POST[company_name]}'",".
    "'"{$_POST[address]}'",'"{$_POST[address2]}'",'"{$_POST[city]}'",'"{$_POST[state]}'",".
    "'"{$_POST[zip]}'",'"{$_POST[country]}'",'"{$_POST[phone]}'",'"{$_POST[fax]}'",".
    "'"{$_POST[email]}'",'"{$_POST[zonemanager]}'",'"{$_POST[transport]}'",".
    "'"{$_POST[fattendee1]}'",'"{$_POST[lattendee1]}'",'"{$_POST[checkboxA1]}'",".
    "'"{$_POST[radio1]}'",'"{$_POST[checkboxE1]}'",'"{$_POST[checkboxF1]}'",".
    "'"{$_POST[checkboxG1]}'",'"{$_POST[checkboxH1]}'",'"{$_POST[checkboxI1]}'",".
    "'"{$_POST[checkboxJ1]}'",'"{$_POST[checkboxK1]}'",'"{$_POST[dietary1]}'")";

您的`sql_statment是错误的。

$sql_statement = 'INSERT INTO 2014_registrations'. 
    '(confirm_number,timecode,company_name,country,address1,address2,city'.
    ',state,zip,phone,fax,email,zone_manager,transport,first_name,'.
    'last_name,tuesday_tours,tuesday_meat,wed_lunch,wed_dinner,'.
    'wed_pool_tourney,thurs_lunch,thurs_dinner,fri_shop,fri_tour,dietary)'.
    'VALUES ("$_POST[confirm]","$_POST[timecode]","$_POST[company_name]",'.
    '"$_POST[address]","$_POST[address2]","$_POST[city]","$_POST[state]",'.
    '"$_POST[zip]","$_POST[country]","$_POST[phone]","$_POST[fax]",'.
    '"$_POST[email]","$_POST[zonemanager]","$_POST[transport]",'.
    '"$_POST[fattendee1]","$_POST[lattendee1]","$_POST[checkboxA1]",'.
    '"$_POST[radio1]","$_POST[checkboxE1]","$_POST[checkboxF1]",'.
    '"$_POST[checkboxG1]","$_POST[checkboxH1]","$_POST[checkboxI1]",'.
    '"$_POST[checkboxJ1]","$_POST[checkboxK1]","$_POST[dietary1]")';

更改为:

$sql_statment = "INSERT INTO 2014_registrations". 
    "(confirm_number,timecode,company_name,country,address1,address2,city".
    ",state,zip,phone,fax,email,zone_manager,transport,first_name,".
    "last_name,tuesday_tours,tuesday_meat,wed_lunch,wed_dinner,".
    "wed_pool_tourney,thurs_lunch,thurs_dinner,fri_shop,fri_tour,dietary)".
    "VALUES ($_POST['confirm'],$_POST['timecode'],$_POST['company_name'],".
    "$_POST['address'],$_POST['address2'],$_POST['city'],$_POST['state'],".
    "$_POST['zip'],$_POST['country],$_POST[phone'],$_POST['fax'],".
    "$_POST['email'],$_POST['zonemanager'],$_POST['transport'],".
    "$_POST['fattendee1'],$_POST['lattendee1'],$_POST['checkboxA1'],".
    "$_POST['radio1'],$_POST['checkboxE1'],$_POST['checkboxF1'],".
    "$_POST['checkboxG1'],$_POST['checkboxH1'],$_POST['checkboxI1'],".
    "$_POST['checkboxJ1'],$_POST['checkboxK1'],$_POST['dietary1']")";

如果使用$sql_statment = '',则不能将变量放在$sql_statment = '$_POST[confirm]';中,因为它会将其视为文本。你必须把它做成$sql_statment = $_POST['checkboxG1'].','.$_POST['checkboxH1'].','.$_POST['checkboxI1'].','.另一种方法是像我一样将其全部更改为$sql_statment = "$_POST['checkboxG1'],$_POST['checkboxH1'],$_POST['checkboxI1'],";

注意使用'和";"有区别

Btw。您应该使用一些安全性,例如mysql_escape_string