INSERT 查询在 php 中使用 mysql 返回 false.使用 msqli_query($dbcon，查询） - The INSERT query returns false in php with mysql. Using msqli_query($dbcon, query)

我正在尝试将数据插入表中，并且正在使用mysqli API执行查询。

$insert = "INSERT INTO pdhp_patient 
                   (username, password, email, first_name,     
                    last_name, dob, gender, s_s_n, i_n) 
            VALUES ('$username', '$password', '$email', '$first_name', 
                    '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";

这是我尝试执行的查询。

mysqli_query($connection, $insert);

上一行代码用于执行查询。这次查询返回 false。我无法理解错误是什么，我什至在查询中没有单引号的情况下尝试过。但是，这不起作用。

已编辑：

$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$dob = $_POST['dob'];
$dob = date("m-d-Y", strtotime($dob));
$gender = $_POST['gender'];
$cid = $_POST['country'];
$sid = $_POST['city'];
$s_s_n = $_POST['s_s_n'];
$i_n = $_POST['i_n'];
global $connection;


if(isset($_POST['type']) && $_POST['type']==="patient"){
    $insert = "INSERT INTO pdhp_patient (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ('$username', '$password', '$email', '$first_name', '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";
    $insert = mysql_prep($insert);
        $result = mysqli_query($connection, $insert); 
if ( $result === false ) {
echo mysqli_error($connection);
exit;
}
        if($val){
        echo "This must be working";
    }else{
        echo "This was not working";
    }
}elseif(isset($_POST['type']) && $_POST['type']==="doctor"){
    $insert = "INSERT INTO pdhp_doctor (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ($username, $password, $email, $first_name, $last_name, $dob, $gender, $s_s_n, $i_n);";
    $insert = mysql_prep($insert);
    mysqli_query($connection, $insert);
}elseif(isset($_POST['environment_radio']) && $_POST['type']==="environment"){
    $insert = "INSERT INTO pdhp_environmentalist (username, password, email, first_name, last_name, dob, gender, s_s_n, i_n) VALUES ($username, $password, $email, $first_name, $last_name, $dob, $gender, $s_s_n, $i_n);";
    $insert = mysql_prep($insert);
    mysqli_query($connection, $insert);
}

更多代码以获取正确的信息。这个代码块是我想要实现的。这是完整的代码。谢谢。

给一个人一条鱼，他今天吃。授人以鱼，他天天吃

添加一些错误检查

$insert = "INSERT INTO pdhp_patient 
                   (username, password, email, first_name,     
                    last_name, dob, gender, s_s_n, i_n) 
            VALUES ('$username', '$password', '$email', '$first_name', 
                    '$last_name', '$dob', '$gender', '$s_s_n', '$i_n');";

$result = mysqli_query($connection, $insert); 
if ( $result === false ) {
    echo mysqli_error($connection);
    exit;
}

那么你也许可以修复自己的错误

根据您的更新和评论，您的问题是您正在转义整个查询，而不是您传入的值。这不是转义的工作方式，转义可以转义值，以防它们包含会破坏SQL封装的'。所以相反..

$username = mysqli_real_escape_string($connection, $_POST['username']);
$password = mysqli_real_escape_string($connection, $_POST['password']);
$email = mysqli_real_escape_string($connection, $_POST['email']);
$first_name = mysqli_real_escape_string($connection, $_POST['first_name']);
$last_name = mysqli_real_escape_string($connection, $_POST['last_name']);
$dob = mysqli_real_escape_string($connection, $_POST['dob']);
$dob = mysqli_real_escape_string($connection, date("m-d-Y", strtotime($dob)));
$gender = mysqli_real_escape_string($connection, $_POST['gender']);
$cid = mysqli_real_escape_string($connection, $_POST['country']);
$sid = mysqli_real_escape_string($connection, $_POST['city']);
$s_s_n = mysqli_real_escape_string($connection, $_POST['s_s_n']);
$i_n = mysqli_real_escape_string($connection, $_POST['i_n']);

并摆脱mysql_prep.您可能应该阅读更多有关SQL注入的信息：

http://php.net/manual/en/security.database.sql-injection.phphttps://www.owasp.org/index.php/SQL_Injection

更安全的方法是将参数化查询与预准备语句一起使用。

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php