如何在php mysql提交表单中停止自动乘法

Question

this code is working fine but my problem is that when i submit (size) row data using php this php code so it is auto multiply and submit in phpmyadmin like that 350000

example i submit a form and (size) row data is

480 x 800 pixels, 4.3 inches (~217 ppi pixel density) Sensors: Accelerometer, proximity

and when i check phpmyadmin (size) row so it is auto multiply and submit the (size) row data like this

350000

how can i solve this problem please help me to fix this issue

thanks

this is php mysql form data submit code

<?php
    /* 
     NEW.PHP
     Allows user to create a new entry in the database
    */

     // creates the new record form
     // since this form is used multiple times in this file, I have made it a function that is easily reusable
     function renderForm($model, $category, $weight,$size, $error)
     {
     ?>

     <?php 


     // if there are any errors, display them
     if ($error != '')
     {
     echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
     }
     ?> 

     <?php 
     }


     //This is the directory where images will be saved
    $target = "media/";
    $target = $target . basename( $_FILES['photo']['name']);

    //This gets all the other information from the form

    $photo=($_FILES['photo']['name']);
    //Writes the photo to the server
    if(move_uploaded_file($_FILES['photo']['tmp_name'], $target))
    {

    //Tells you if its all ok
    echo "<center>Photo ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory</center>";
    }


        //connect to database

         mysql_connect('localhost','root','password');
         mysql_select_db('price');



     // check if the form has been submitted. If it has, start to process the form and save it to the database
     if (isset($_POST['submit']))
     { 
     // get form data, making sure it is valid
     $model = mysql_real_escape_string(htmlspecialchars($_POST['model']));
     $category = mysql_real_escape_string(htmlspecialchars($_POST['category']));
     $weight = mysql_real_escape_string(htmlspecialchars($_POST['weight']));
     $size = mysql_real_escape_string(htmlspecialchars($_POST['size']));
     $entertainment = mysql_real_escape_string(htmlspecialchars($_POST['entertainment']));
     $price = mysql_real_escape_string(htmlspecialchars($_POST['price']));
     $date = mysql_real_escape_string(htmlspecialchars($_POST['date']));
     $photo = mysql_real_escape_string(htmlspecialchars($_FILES['photo']['name']));

     // check to make sure both fields are entered
     if ($model == '' || $category == '')
     {
     // generate error message
     $error = 'ERROR: Please fill in all required fields!';

     // if either field is blank, display the form again
     renderForm($model, $category, $weight, $size,$error);
     }
     else
     {
     // save the data to the database
      mysql_query("INSERT mprice SET model='$model', category='$category',  weight='$weight',  size='$size',  entertainment='$entertainment', price='$price', date='$date', photo='$photo'")
     or die(mysql_error()); 
     echo "<center>Done!</center>";
     // once saved, redirect back to the view page

     }
     }
     else
     // if the form hasn't been submitted, display the form
     {
     renderForm('','','','','','','','');
     }




    ?>

Answer 1

You are experiencing sql injection. That is, you are allowing code submitted by a user to be run in your database server. The string 480 * 800 is code and the MySQL server is running it for you.

This is not a cool feature on the open internet. Lucky for you, you don't have a ;DROP TABLE mprice; accelerometer in one of your rows, eh?

Please consider using bind variables. This is easiest to do if you upgrade your MySQL API to mysqli_ or PDO .