我正在嘗試測試一個非常簡單的PHP表單，它將輸入插入到SQL數據庫中。連接工作正常，但刷新數據庫時數據未出現在數據庫中。我只有兩個文件，一個索引.html和一個進程.php。索引.html：<html><head>Testing</head><body> <div id="frm"> <form action="process.php" method=POST> <p> <label>Username</label> <input type="text" id="stuff" name="stuff"> </p> <p> <input type="submit" id="btn" value="Login"> </p> </form> </div></body></html>過程.php：<?php $userinput = $_POST['stuff']; $servername = "localhost"; $username = "root"; $password = ""; $database = "testing"; $conn = new mysqli($servername, $username, $password, $database); if ($conn->connect_error) { die("connection failed: " . $conn->connect_error); } else { echo "Connected successfully "; echo $userinput; $sql = "INSERT INTO `entries`(`input`) VALUES ('$userinput')"; }?>
1 回答
明月笑刀無情
TA貢獻1828條經驗 獲得超4個贊
問題是您實際上并沒有運行查詢。您剛剛將查詢字符串分配給變量，因此它不會在MySQL中執行。
您的代碼容易受到SQL注入的攻擊，因此我提出了一個解決方案：
<?php
$userinput = $_POST['stuff'];
$servername = "localhost";
$username = "root";
$password = "";
$database = "testing";
$conn = new mysqli($servername, $username, $password, $database);
if ($conn->connect_error)
{
die("connection failed: " . $conn->connect_error);
}
else
{
echo "Connected successfully ";
echo $userinput;
$sql = "INSERT INTO `entries` (`input`) VALUES (?)";
if ($stmt = $conn->prepare($sql)) { // Prepare statement
$stmt->bind_param("s", $userinput); //Bind the string (s), with the content from $userinput to the statement marker (?)
$stmt->execute(); // Run (execute) the query
$stmt->close(); //clean up
}
此代碼應該有效，并且還可以保護您免受SQL注入的影響。
- 1 回答
- 0 關注
- 130 瀏覽
添加回答
舉報
0/150
提交
取消