Android MYSQL插入无效

Question

I am attempting to insert an objetc into a table on my database using the following Code:

PHP:

$sql = mysql_query("INSERT INTO order (placer_name, item_name, payment_amount, location_string, location_lat, location_long) VALUES('$_POST[PlacerName]', '$_POST[ItemName]', '$_POST[Payment]', '$_POST[Location]', '$_POST[Lat]', '$_POST[Long]')");     

        if($sql){
             echo 'Success';
        }
        else{
            echo 'Error occured.';
        }
}

JAVA:

 // POST ORDER
    public void order(String nm, String pay, String location) {
        itemName = nm;
        paymentAmount = pay;
        locationString = location;
        if (Utility.getCurrentLocation() != null) {
            handler.post(new Runnable() {
                public void run() {
                    new OrderTask().execute((Void) null);
                }
            });
        } else {
            // Cannot Determine Location
            showMessage("Cannot Determine Location.");
        }
    }

    class OrderTask extends AsyncTask<Void, Void, Boolean> {
        private void postData() {
            if (user.loggedIn) {
                HttpClient httpclient = new DefaultHttpClient();
                HttpPost httppost = new HttpPost(
                        "http://cyberkomm.ch/sidney/php/postOrder.php");
                try {
                    ArrayList<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(
                            6);
                    nameValuePairs.add(new BasicNameValuePair("PlacerName",
                            user.userName));
                    nameValuePairs.add(new BasicNameValuePair("ItemName",
                            itemName));
                    nameValuePairs.add(new BasicNameValuePair("Payment",
                            paymentAmount));
                    nameValuePairs.add(new BasicNameValuePair("Location",
                            locationString));
                    nameValuePairs.add(new BasicNameValuePair("Long", String
                            .valueOf(user.longitude)));
                    nameValuePairs.add(new BasicNameValuePair("Lat", String
                            .valueOf(user.latitude)));
                    httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
                    HttpResponse response = httpclient.execute(httppost);
                    BufferedReader in = new BufferedReader(
                            new InputStreamReader(response.getEntity()
                                    .getContent()));
                    StringBuffer sb = new StringBuffer("");
                    String line = "";
                    while ((line = in.readLine()) != null) {
                        sb.append(line);
                        break;
                    }
                    in.close();
                    responseString = sb.toString();
                    if (responseString.equals("Success")) {
                        // Order Placed
                        showMessage("Success. Order Placed!");
                        user.onPlaced();
                    } else {
                        // Failed
                        showMessage("Failed. " + responseString);
                    }
                } catch (Exception e) {
                    Log.e("log_tag", "Error:  " + e.toString());
                }
            } else {`enter code here`
                // Must Login
                showMessage("Must Login");
            }
        }

        @Override
        protected Boolean doInBackground(Void... params) {
            postData();
            return null;
        }
    }

DATABASE:

When I run the code, the sql always returns 'Error Occured', which means that it fails to execute the query:

"INSERT INTO order (placer_name, item_name, payment_amount, location_string, location_lat, location_long) VALUES('$_POST[PlacerName]', '$_POST[ItemName]', '$_POST[Payment]', '$_POST[Location]', '$_POST[Lat]', '$_POST[Long]')"

I checked the syntax, and everything seems to be in order, but I had some guesses as to what could be wrong, but I am not sure:

Type Issues with integers, doubles Parameter Values

Thank you for your help.

Answer 1

order is a MySQL reserved word.

http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

either wrap it in backticks, or use another word for it, such as orders , that would be OK.

"INSERT INTO `order`

having error reporting on, would have signaled that.

error_reporting(E_ALL);
ini_set('display_errors', 1);

http://php.net/manual/en/function.error-reporting.php

the SQL error message would have been:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order

---

Plus, your present code is open to SQL injection . Use mysqli with prepared statements , or PDO with prepared statements .