使用PHP将HTML表单数据插入MySQL数据库[关闭]

Question

我必须插入：用户通过HTML表单传递给PHP页面的名称，姓氏，电子邮件，用户名和密码：

<?php
$name = $_POST["nm"];
$surname = $_POST["cgn"];
$email = $_POST["ml"];
$username = $_POST["nkn"];
$password = $_POST["psw1"];

// Connection to DB Server
$conn = mysqli_connect("localhost","root","","mydb");
// Check
if (!$conn){
  echo "connection to database failed";
  exit();
}
$query = "SELECT username FROM users WHERE username = '".$username."'";
$result = mysqli_query($conn,$query);
$row = mysqli_fetch_array($result,MYSQLI_NUM);
$n = mysqli_affected_rows($conn);
if($n >= 1){
    echo "Username already exist";
}else{
    $insert = "INSERT INTO users (name,surname,email,username,password) VALUES ('$name','$surname','$email','$username','$password')";
    mysqli_query($conn,$insert);
?>
<p>User: <?php echo $username ?> successfully added.</p>
<?php
}
mysqli_close($conn);
?>

问题是这段代码总是不起作用。 有时会写“User：****成功添加”，但在数据库表中却没有出现。 我不知道为什么。

---

解：

使用mysqli_real_escape_string(connection,string)

Answer 1

在插入SQL之前转义字符串。

你可以试试mysql_real_escape_string（）函数。

http://php.net/manual/en/function.mysql-real-escape-string.php

或者你的情况下是mysqli_real_escape_string（）。

http://php.net/manual/en/mysqli.real-escape-string.php

此外，您应该检查返回值以查看插入SQL是否真的成功。

$name = mysqli_real_escape_string($name);
$surname = mysqli_real_escape_string($surname);
$email = mysqli_real_escape_string($email);
$username = mysqli_real_escape_string($username);
$password = mysqli_real_escape_string($password);
$insert = "INSERT INTO users (name,surname,email,username,password) VALUES ('$name','$surname','$email','$username','$password')";
mysqli_query($conn,$insert);