每次我尝试使用Swift和Alamofire将数据发布到MySQL数据库时，数据是否显示为null？

Question

func uploadPostData() {

    let parameters: [String: Any] =
        ["title": "\(titleName!)", // string
        "link": "\(link!)", // string
        "available_shares": sharesNum!, // int
        "risk": riskLevel!, // int
        "description": descriptionView.text!, // string
        "postID": postID, // string
        "price": 0.99,
        "timestamp": 700
        ]
    print(parameters)

    Alamofire.request("example.com", method: .post, parameters: parameters, encoding: URLEncoding.httpBody, headers: nil)
        .responseJSON() { response in
            switch response.result {



    }
}

Above is my Swift method that calls the PHP script, which I'll attach below. I believe the problem lies in my PHP, as the POST request was definitely received. My database actually does update when the method is called, but the data in all of the columns is null/a default value. I tried printing out the parameters dictionary, but it appears completely as expected, with no null values.

    <?php

    $item1 = $_POST['title'];
    $item2 = $_POST['link'];
    $item3 = $_POST['available_shares'];
    $item4 = $_POST['risk'];
    $item5 = $_POST['description'];
    $item6 = $_POST['postID'];
    $item7 = $_POST['price'];
    $item8 = $_POST['timestamp'];

// Create connection
    $mysqli=mysqli_connect("localhost","username","password","database"); 

// Check connection
    if (mysqli_connect_errno())
    {
      echo "
Failed to connect to MySQL: " . mysqli_connect_error();
    }

    $query = "INSERT INTO `TB_POSTS` (postID, timestamp, link, price, title, available_shares, risk, description) VALUES ('".$item6."','.$item8.','".$item2."','".$item7."','".$item1."','".$item3."','".$item4."','".$item5.")";

    $result = mysqli_query($mysqli,$query);

    echo $result; // sends 1 if insert worked
?>

The bottom line, which outputs 1 if the insertion worked, surprisingly does work. But again, the problem seems to be that the updated data never actually appears in the database. I know it is updating because there is one more row in the table, but the actual values are never present. I also got the Alamofire.AFError.ResponseSerializationFailureReason.inputDataNilOrZeroLength error when I used .responseJSON, but when I changed it to .responseString I would get an output of 'SUCCESS'. Thanks a lot to anyone who can help.

Answer 1

You should use parameterized queries to prevent sql injection. Here is a link that you should read through and then bookmark so you have it for quick reference.

https://websitebeaver.com/prepared-statements-in-php-mysqli-to-prevent-sql-injection

I updated your code using parameterized queries as a model for you to examine.

$item1 = $_POST['title'];
$item2 = $_POST['link'];
$item3 = $_POST['available_shares'];
$item4 = $_POST['risk'];
$item5 = $_POST['description'];
$item6 = $_POST['postID'];
$item7 = $_POST['price'];
$item8 = $_POST['timestamp'];

// Create connection
$mysqli=mysqli_connect("localhost","username","password","database"); 

// Check connection
if (mysqli_connect_errno()){
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$query = "INSERT INTO `TB_POSTS` 

(
  postID, 
  timestamp, 
  link, 
  price, 
  title, 
  available_shares, 
  risk, 
  description 

) VALUES(?, ?, ?, ?, ?, ?, ?, ?)";

$stmt = $mysqli->prepare($query);  //Prepare
$stmt->bind_param("ssssssss", $item6, $item8, $item2, $item7, $item1, $item3, $item4, $item5);  //Bind
$stmt->execute();//Execute
if($stmt->affected_rows === 0) exit('Nothing was inserted.');  //Check to see if it worked
$stmt->close();