警告：PDOStatement :: execute（）：SQLSTATE [HY093]：无效的参数编号：在第24行的C：\\ wamp \\ www \\ PDO.php中未定义参数

Question

今天，我正在尝试我的代码，但遇到了这个错误：参数未定义...请帮助我：

    <?php
    $user = 'dbuser';
    $pass = 'pwd';
    $db = new PDO( 'mysql:host=localhost;
dbname=registration', $user, $pass );
    $form = $_POST;
    $firstname = $form[ 'firstname' ];
    $lastname = $form[ 'lastname' ];
    $username = $form[ 'username' ];
    $email = $form[ 'email' ];
    $password = $form[ 'password1' ];
    $dateofbirth = $form[ 'dateofbirth' ];
    $monthofbirth = $form[ 'monthofbirth' ];
    $yearofbirth = $form[ 'yearofbirth' ];
    $gender = $form[ 'gender' ]; 
    $sql = "INSERT INTO members ( firstname, lastname, username, email,
password, dateofbirth, monthofbirth, yearofbirth, gender ) 
VALUES ( :firstname, :lastname, :username, 
:email, :password1, :dateofbirth, :monthofbirth, :yearofbirth,
:gender )";
    $query = $db->prepare( $sql );
    $query->execute( array( ':firstname'=>$firstname, ':lastname'=>      $lastname, 
':username'=>$username, ':email'=>$email, ':password'=>$password, 
':dateofbirth'=>$dateofbirth, ':monthofbirth'=>$monthofbirth, 
':yearofbirth'=>$yearofbirth, ':gender'=>$gender ) );
    $result = $query->execute( array( ':firstname'=>$firstname,                                                 ':lastname'=>$lastname, 
':username'=>$username, ':email'=>$email, ':password'=>$password, 
':dateofbirth'=>$dateofbirth, ':monthofbirth'=>$monthofbirth, 
':yearofbirth'=>$yearofbirth, ':gender'=>$gender ) );
    if ( $result ){
    echo "<p>Thank you. You have been registered</p>";
    } else {
    echo "<p>Sorry, there has been a problem inserting your details.         Please contact admin.</p>";

}？>

Answer 1

在要传递给PDO::prepare的查询字符串中，您具有以下参数：

:email, :password1

但是，您要传递给PDOStatement::execute的数组没有:password1键，而是具有:password键。 这是一个简单的错字：修复一个或另一个。

不过，在将实际提交的数据存储在数据库中之前，最好先清理掉它。 诸如电子邮件地址之类的内容很容易通过以下方式进行验证：

if (!filter_var($email, FILTER_VALIDATE_EMAIL))
{
    printf(
        '%s is not a valid email address, please fill in correct values',
         $email
    );
    //rebuild form, and return response to client
}
else
{
    //carry on validating data, eventually insert it in the DB
}

同样重要的是不要忘记使用isset来检查post参数，如果您不这样做的话，代码会并且会产生很多通知。