使用PHP将数据插入MySQL的问题

Question

I am new to PHP. I've been working on a simple form that submits data into a MySQL database and have hit a snag. I'm just not sure where the error in the code is, any help would be appreciated.

<?php

$host      = 'localhost'; // hostname
$username  = 'root'; // MySQL Username
$password  = 'root'; // MySQL Password
$db_name   = 'idp'; // Database name
$tbl_name  = 'data'; // Table name

// Attempt MySQL Connection
mysql_connect("$host", "$username", "$password")or die("Cannot connect.");
// Attempt database connection
mysql_select_db("$db_name")or die("Cannot select DB.");

$name      = $_POST['name'];
$mbr_name   = $_POST['mbr_name'];
$mbr_tel   = $_POST['mbr_tel'];
$date      = $_POST['date'];

$sql     = "INSERT INTO $tbl_name(name, mbr_name, mbr_tel, date)VALUES('$name',       '$mbr_name', '$mbr_tel', '$date')";
$result  = mysql_query($sql);

if($result) {
echo "Entry Successful";
echo "<br>";
echo "<a href='form.php'>Return to Form</a>";
} else {
echo "<strong>Error</strong>";
}

mysql_close();
?>

Answer 1

My guess is, one of the input parameters you are getting has unescaped ' or " character(s) in it. Thus, your query breaks due to the unintended quote characters. To verify if this is the case, introduce another print statement for the sql just after you have created your sql statement and run it in manually in your query browser and see if it works.

Further, the if($result) { block in your code prints out a success or failure message irrespective of why the failure occured, so the output information is not particularly useful either.

You should have a look at the [addslashes][1] method to escape those quote characters.

Your query will then become somthing like

$sql = "INSERT INTO $tbl_name(name, date)VALUES('".addslashes($name)."', '".$date."')";

Also, I would suggest having a look at pdo for your sql queries instead of mysql_* functions.

Answer 2

Remove the "" on your mysql_connect($host,$username,$password); mysql_select_db($db_name); Its a good habit

$sql = "INSERT INTO $tbl_name(name, mbr_name, mbr_tel, date)VALUES('{$name}','{$mbr_name}','{$mbr_tel}', '{$date}')";

Also check your data type for date. If the date you are posting is current , you can use sql function instead of the POST for date for example:

$sql = "INSERT INTO $tbl_name(name, mbr_name, mbr_tel, date)VALUES('{$name}','{$mbr_name}','{$mbr_tel}',NOW())";

Answer 3

尝试你这样查询：

$sql     = "INSERT INTO $tbl_name(name, mbr_name, mbr_tel, date)VALUES('".$name."',       '".$mbr_name."', '".$mbr_tel."', '".$date."')";

Answer 4

your code is deprecated, please refer to Zend classes loader, with the Zend_db_* classes.

[http://framework.zend.com/manual/1.12/fr/zend.db.statement.html][1]

PS : Zend is a Framework, you could use any popular framework like Yii, CakePhp and others.