从html页将数据插入数据库表时出现错误

Question

这是我的php代码，在插入数据行时警告我，请提供答案

                if($_POST['submitted'] == 1){

                    $q = "INSERT INTO user(fullname,email,password,conform-password,mobileno) VALUES ('$_POST[form-full-name]','$_POST[form-email]','$_POST[form-password]','$_POST[form-conform-password]','$_POST[form-mobile-no]')";

                    $r= mysqli_query($dbc,$q); 

                    if($r){

                        echo '<p>you are REGISTERED SUCCESSFULLY !</p>';
                    }
                    else{

                        echo '<p>your REGISTRATION FAILED !</p>'.mysqli_error($dbc);
                        echo '<p>'.$q.'</p>';
                    }

                }

//“请给我解决我的问题的方法”

块引用

Answer 1

如果您不想分配变量以便不分配内存，则可以尝试使用以下方法：

           <?php

            if($_POST['submitted'] == 1){

                  $q = "INSERT INTO user(`fullname`,`email`,`password`,`conform-password`,`mobileno`) VALUES (?,?,?,?,?)";

                  $stmt = $mysqli->prepare($q);

                    if ( false===$stmt ) {

                    die('prepare() failed: ' . htmlspecialchars($mysqli->error));
                    }

                  $rc = $stmt->bind_param("sssss",  $_POST['form-full-name'], $_POST['form-email'], $_POST['form-password'], $_POST['form-conform-password'],$_POST['form-mobile-no']);


                  if ( false===$rc ) {

                      die('bind_param() failed: ' . htmlspecialchars($stmt->error));
                    }

                  $rc = $stmt->execute();
                    if ( false===$rc ) {
                      die('execute() failed: ' . htmlspecialchars($stmt->error));
                    }

                   $stmt->close();


            }

根据此示例，您必须在表字段中使用手机号码数据类型作为字符串。

不需要在表中保存确认密码，您应该使用prepare语句进行插入。 在这种情况下，它将确保您的查询安全插入

Answer 2

尝试这个

 if($_POST['submitted'] == 1)
{

  $full_name =$_POST['form-full-name'];
  $form_email=$_POST['form-email'];
  $password = $_POST['form-password'];
  $conform_pass=$_POST['form-conform-password'];
  $mobile =$_POST['form-mobile-no'];

  $q = "INSERT INTO user(fullname,email,password,conform-password,mobileno) VALUES ('$full_name','$form_email','$password','$conform_pass','$mobile')";

  $r= mysqli_query($dbc,$q); 

  if($r)
  {

   echo '<p>you are REGISTERED SUCCESSFULLY !</p>';
  }
  else{

    echo '<p>your REGISTRATION FAILED !</p>'.mysqli_error($dbc);
    echo '<p>'.$q.'</p>';
      }

    }

您缺少单引号$_POST['']方法

Answer 3

Just try saving your posted form data to php variable and then use that in   your insert query.

For ex: 

$fullname = $_POST['form-full-name'];
$email = $_POST['form-email'];
$password = $_POST['form-password'];
$confirmpassword = $_POST['form-conform-password'];
$mobilenumber = $_POST['form-mobile-no'];

And then the query as 


$q = "INSERT INTO user(fullname,email,password,conform-password,mobileno) VALUES ('$fullname','$email ','$password ','$confirmpassword ','$mobilenumber ')";


Hope this help.

Answer 4

谢谢大家的答复，我解决了一个我犯了2个错误的问题1）使用“-”，我用_下划线（ex：form_email）代替了2）我使用过isset（）函数更改以上2件事后，我正在获取数据我的数据库