Question

在类似问题上,有几个职位,但我仍然无法对我的法典,即PHP和MySQL的组合作出明确的回答。我在提交表格后总是收到错误信息。具体地说,它与yn有关。有趣的是,我的sql没有抱怨,我也没有说过,而是在我的浏览器(火).)上。

$add_master_sql = "INSERT INTO master_name (date_added, date_modified, f_name, l_name)
VALUES (now(), now(),  ".$_POST["f_name"]." ,  ".$_POST["l_name"]." )";
$add_master_res = mysqli_query($mysqli, $add_master_sql) or die(mysqli_error($mysqli));

我的MYSQL法典是:

CREATE TABLE master_name (
  id INT NOT NULL PRIMARY KEY AUTO_INCREMENT,
  date_added DATETIME,
  date_modified DATETIME,
  f_name VARCHAR (75),
  l_name VARCHAR (75)
);

某些因素可能与引证有关,但我把对口的检查增加一倍,罚款。谁能帮助我去做?

Answer 1

More important is to use pdo prepared queries to avoid possible sql injection.

<?php
// configuration
$dbtype     = "sqlite";
$dbhost             = "localhost";
$dbname     = "test";
$dbuser     = "root";
$dbpass     = "admin";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

// new data
$dateAdded = getdate();
$dateModified = getdate();
$f_name = $_POST["f_name"];
$l_name = $_POST["l_name"];

// query
$sql = "INSERT INTO master_name (date_added, date_modified, f_name, l_name) VALUES (:f_name, :l_name, :dateAdded, :dateModified)";
$q = $conn->prepare($sql);
$q->execute(array( :dateAdded =>$dateAdded ,
                   :dateModified =>$dateModified,
                   :f_name =>$f_name,
                   :l_name =>$l_name));    

?>

Answer 2

外地清单中未知栏目

Find the query that is using column address in field list .
The one you posted here is apparently not the one issuing this error.
Change your die(mysqli_error($mysqli)); to

trigger_error(mysqli_error($mysqli));

for all the queries on the page
and see certain place where the error occurred.

还指出,你应当利用<密码>mysqli_real_einski_string <<>/code>,从问询中提取的每一变数。 (并保护从Kall注入中产生的所有其它变量)或将其列为编制的声明。

如果贵书没有告诉你——烧掉!

友情链接