我的mySQL查询出了什么问题？

Question

I am trying to get my query to work and I can't seem to find what is wrong with it. It is for a from btw.

//Connection
$dbhandle = mysql_connect($hostname, $username, $password) or die("Unable to connect.");
$selected = mysql_select_db("fblaWebsite",$dbhandle) or die("Could not select the database");

//execute the SQL query 
        $insertQuery = "INSERT INTO Bookings (band, occasion, placeName, address, city, state, email, firstName, lastName, comments, ticketsForSale, phoneNumber, ticketPrice, date, time)
        VALUES ('$band', '$occasion', '$placeName', '$address', '$city', '$state', '$email', '$firstName', '$lastName', '$comments', '$ticketsForSale', '$phoneNumber', '$ticketPrice', '$date', '$time')";
        if(mysql_query($insertQuery)){
            echo "Form Successfully Submited!";
        }
        else{
            echo "Error Submiting Form!";
        }

I can't seem to find the error. I just keep getting "Error Submiting Form!"

Answer 1

As others have recommended, PDO would be very helpful for this.

However, since your question isn't using PDO, and I don't see the values for your variables, I would recommend that you call mysql_error() in your else condition, and output it to the screen (in development only!) in order to see what the last error from MySQL was.

That will give you a starting point for solving your particular problem.

I also second the recommendation about making sure you sanitize your input values, and ensure that no harmful values are being substituted into your sql statement. If you aren't using it, may I recommend mysql_escape_string .

Keep in mind that vanilla mysql drivers are slated for deprecation in 5.5. Seriously consider upgrading to MySQLi or PDO to avoid your code breaking in PHP 5.5 environments!

Here is PHP's FAQ on the deprecation and changing to one of the new mechanisms: Why is the MySQL extension (ext/mysql) that I've been using for over 10 years discouraged from use? Is it deprecated? What do I use instead? How can I migrate?

Answer 2

The below code should get you started with connecting to PDO, and executing a simple insert query as with your example.

$db = new PDO('mysql:host=localhost;dbname=testdb;charset=utf8', 'username', 'password');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

try {
    //connect as appropriate as above
     $stmt = $db->prepare("INSERT INTO Bookings (band, occasion, placeName, address, city, state, email,     firstName, lastName, comments, ticketsForSale, phoneNumber, ticketPrice, date, time)     Values(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?");
     $stmt->execute(array($band, $occasion, $placeName, $address, $city, $state, $email, $firstName, $lastName,     $comments, $ticketsForSale, $phoneNumber, $ticketPrice, $date, $time));
     $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
} catch(PDOException $ex) {
    echo "An Error occured!"; //user friendly message
    //The line below will echo the error message from the query if there is one.
    //echo $ex->getMessage();
}

Answer 3

You don't need pdo to get an answer. Just use something like this. Use it for testing and it'll give you an idea where the error is.

$result = mysql_query($query) or die("Bad query 1: " .mysql_error());

Now... watch how many down votes I get for saying you don't need PDO.

You can do prepared statements in procedural code too. It is a good idea to learn that method or you'll be forever going back protecting against sql injection a dozen different ways.

edit:

I forgot to say that you should move over to mysqli statements and away from the older depreciated mysql statements. Chances are the example you found was 10 years old. Learning php and sql is a voyage of discovery, it helps if you get off on the wrong foot. I'd take a look at this for some examples. http://us1.php.net/manual/en/mysqli.query.php

EDIT:

As Dennis pointed out, you should probably learn Mysqli Prepared Statements instead. It would be a LOT smarter at this juncture and you can still use Procedural code. Lots of examples here on Stackoverflow about how to do those. mysqli_stmt_fetch returns number