使用php将刮取的变量插入到mysql表中

Question

I have been looking to make a very simple database, which has 4 columns. First is a local int that auto incriments, 2nd is a single digit ID int, 3rd is another INT and fourth is the scraped variable (string). Problem I am having however is with the actual inserting of the 3 variables.

I have the $charIDs variable increase by 1 at the end of a for loop, which is used in the url I am scraping. the $server variable is just a static int, and the $trimmedName variable is the actual text I scrape from each web page and it works great.

for($i = 1; $i <= 5; $i++){
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, "http://website.com/asddas/asda/search?=$charIDs");
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true);

$content = curl_exec($ch);

$dom = new DOMDocument();
$dom->loadHTML($content);

$xpath = new DOMXPath($dom);

$tags = $xpath->query('//*[@id="div_contents"]/div[2]/div[2]/div[2]/div[1]/dl/dd/span/text()');
foreach ($tags as $tag) {
    trim($name = $tag->nodeValue);
}
if ($name != null){

$trimmedName = trim($name);

$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$sql = "INSERT INTO players (serverID, charID, charName)
VALUES ('$server', '$charIDs', '$trimmedName')";

$conn->close();
$name = null;
$trimmedName = null;
}
$charIDs++;
}

I've checked variables, table names, etc and I am not sure why it isn't working. I am able to insert rows manually into the database.

Answer 1

Here are some things I have noticed about your script.

1) You are not executing the query, this is the big problem.
2) You should still be using parametrized queries.
3) Why bother recreating the mysqli and statement objects on each iteration.

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$sql = "INSERT INTO players (serverID, charID, charName) VALUES (?,?,?)";
$stmt = $conn->prepare($sql);

if (!$stmt) {
    die('could not create statement: ' . $conn->error);
}

for($i = 1; $i <= 5; $i++){
    // curl and XML stuff here
    $binded = $stmt->bind_param('iis', $server, $charIDs, $trimmedName);
    if ($binded) {
        echo ($stmt->execute() ? 'Inserted' : 'Did not insert');
    }
    $charIDs++;
}

$conn->close();

Answer 2

This seems fairly obvious, but I don't see anywhere where you execute the SQL statement. I can't comment on how safe this is as you don't provide what comprises the variables. Hopefully you're incorporating best practices for your data

$sql = "INSERT INTO players (serverID, charID, charName)
VALUES ('$server', '$charIDs', '$trimmedName')";
$conn->query($sql);