将数据插入mysql不起作用 - Inserting data to mysql not working

 <? 
session_start();

 if(($connection = mysql_connect("localhost", "root", "")) == false)
  die ("Couldn't connect to database");
 if(mysql_select_db("Social", $connection) == false)
   die ("Couldn't select db");
 if (isset($_POST['username']) && isset($_POST['pass']) && isset($_POST['login'])){
$sql = sprintf("SELECT * FROM users WHERE username LIKE '%s' AND password LIKE '%s'", $_POST['username'],  $_POST['pass']);
$query = mysql_query($sql);
if (mysql_num_rows($query) == 0){
$error = "<br />Wrong Username or Password";}
 else{
 $_SESSION['user'] = $_POST['username'];
 header("Location: home1.php");
       }
    }

if (isset($_POST['register'])){
         $sql2 = sprintf("INSERT INTO Social.users (username, password) VALUES   (%s, %s)", $_POST['newUser'], $_POST['newPass']);
         $query2 = mysql_query($sql2);
     if (!$query2){
        print "Registration failed";
     }
     else{
    print "Registration sucessfull";
    }
}

？>

我的程序没有在mySQL表中插入任何数据。我知道所有的语法都是正确的，一切都应该很好。我仔细检查了mySQL用于向表中输入数据的命令。为什么不起作用？我的query2应该成功，但我想知道为什么不成功。请帮忙。感谢

要防止sql注入，请尝试mysqli或pdo-

这是mysqli准备的语句版本。但是，如果你正在尝试创建用户管理系统，我不建议你这样做。有这么多脚本可以提供更多的安全性，http://www.usercake.com是一个很好的用户管理系统。

 session_start();
$db = new mysqli('localhost', 'root', 'password', 'database');
 if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}
 if (isset($_POST['username'] && $_POST['pass'] && $_POST['login']))
 {
 $user_name = ''; //define these here. 
 $pass = '';
 $stmt = $db->prepare("select * from users where username = ? and password = ?");
 echo $db->error;//this will echo the error.
 $stmt->bind_param('ss', $user_name, $pass);
 $stmt->execute();
 $result = $stmt->get_result();//get rows
 if($result->num_rows < 1) //check if result is less than 1
{
$error = "<br />Wrong Username or Password";}
 else{
 $_SESSION['user'] = $_POST['username'];
 header("Location: home1.php");
}
}
if (isset($_POST['register'])){
$uname = $_POST['newUser'];
$pass = $_POST['newPass'];
if(empty($uname))
{
echo "Please enter your username.";
}
elseif(empty($pass))
{
echo "Please enter your password.";
}
else{
$stmt = $db->prepare("insert into Social.users (username, password) values (?,?)");
echo $db->error;//this will echo the error.
$stmt->bind_param('ss', $uname, $pass);
$stmt->execute();
echo "You have successfully registered.";
}
}

INSERT中的变量必须是用户名和密码

$sql2 = sprintf("INSERT INTO Social.users (username, password) VALUES   (%s, %s)", $_POST['username'], $_POST['pass']);

使用准备好的语句和参数化查询。这些SQL语句与任何参数分开发送到数据库服务器并由数据库服务器解析。这样，攻击者就不可能注入恶意SQL。

你基本上有两种选择来实现这一点：

使用PDO：

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');
$stmt->execute(array('name' => $name));
foreach ($stmt as $row) {
    // do something with $row
}

使用mysqli：

$stmt=$dbConnection->prepare('SELECT*FROM employees WHERE name=？’($stmt->bind_param('s'，$name(；
$stmt->execute((；
$result=$stmt->get_result((；while($row=$result->fetch_assoc((({//用$row｝做点什么

Font:如何防止PHP中的SQL注入？