使用PHP在MySql数据库中插入数据时遇到问题

Question

This is just a testing page to make sure that I know how to insert data into the database.

This is my login page:

<?php 

$mysql_host = "[HOST REMOVED]";
$mysql_database = "a8700070_test";
$mysql_user = "a8700070_admin";
$mysql_password = "[PASSWORD REMOVED]";
?>

This is the code I have for the form.

<form action="db.php" method="post">

<input name="name" type="text">
<input name="age" type="text">
<input name="title" type="text">
<input name="person" type="text">
<input name="ok" type="text">
<input name="GO!" type="submit"> 



</form>

and this is the code I have that inserts it into the table.

<?php // 
require_once 'login.php';
$db_server= mysql_connect($mysql_host, $mysql_user, $mysql_password);

if (!$db_server) die("Unable to connect to MySQL: " . mysql_error());

mysql_select_db($mysql_database)  or die("Unable to select database: " . mysql_error());

$namer = $_POST["name"];
$age = $_POST["age"];
$tit = $_POST["title"];
$k = $_POST["ok"];
$pers = $_POST["person"];

echo "$namer";

$sql="INSERT INTO test (title,person,age,date,ok)
VALUES($namer,$age,$tit,$k,$pers)"



?>

Answer 1

you need to actually call your query with mysql_query like this:

mysql_query($sql);

You should also remember to escape your input to ensure a user wont abuse it with SQL injection .

Your query should look like this:

$sql = "INSERT INTO test (title,person,age,date,ok) VALUES('".mysql_real_escape_string($namer)."','".mysql_real_escape_string($age)."','".mysql_real_escape_string($tit)."','".mysql_real_escape_string($k)."','".mysql_real_escape_string($pers)."')";

If you're getting an error, you could print the actual error with mysql_error like this:

mysql_query($sql) or die(mysql_error());

Answer 2

You need to seperate the variables in your SQL query with single quotes and should properly escape them...

$sql="INSERT INTO test (title,person,age,date,ok)
VALUES('".mysql_real_escape_string($namer)."','".mysql_real_escape_string($age)."','".mysql_real_escape_string($tit)."','".mysql_real_escape_string($k)."','".mysql_real_escape_string($pers)."')

And then actually run the query eg

$query = mysql_query($sql);