使用PHP将HTML表单连接到SQL数据库

Question

//我创建了一个HTML表单并创建了PHP代码，该代码应该将表单的内容发送到数据库表中，但是当页面返回其原始状态（很好）时，数据就永远不会到达数据库了-没错。

我最初尝试创建一个单独的PHP表单，但经过一些研究后发现，此表单更加有效和简洁。 我只需要它可以工作，并了解它是否有可能无法工作。

<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $firstname = $_POST["firstname"];
    $lastname  = $_POST["lastname"];
    $zipcode   = $_POST["zipcode"];
    $email     = $_POST["email"];
    $subject   = $_POST["subject"];
    $comment   = $_POST["comment"];

    //connect to server
    $dbhost   = "localhost";
    $username = "root";
    $password = "";
    $dbname   = "point12_guestform";

    $mysql = mysqli_connect($dbhost, $username, $password, $dbname);
    $query = "INSERT INTO aboutpage  
        (firstname,lastname,zipcode,email,subject,comment) VALUES 
        $firstname, $lastname, $zipcode, $email, $subject, $comment";
    mysqli_query($mysql, $query);
}
?>  
//HTML Form code
<form method="POST" />
   <br>
   <fieldset>
      <div class="col-50">
         <input type="text" name="firstname" placeholder="First Name" 
            required />
      </div>
      <div class="col-50">
         <input type="text"  name="lastname" placeholder="Last Name"  
            required />    
      </div>
      <div class="col-50">
         <input type="number" name="zipcode" minlength="5" 
            maxlength="5" placeholder="Zip Code (where you live)" 
            required />     
      </div>
      <div class="col-50">
         <input type="email" name="email" placeholder="Email" 
            required />    
      </div>
      <div class="col-50">
         <select name="subject" required>
            <option selected hidden value="">Please select the option 
               that best fits your request.
            </option>
            <option value = "guest">I want to be a guest on the 
               podcast.
            </option>
            <option value = "question">I have a question.</option>
            <option value = "suggestion">I have a suggestion.</option>
         </select>
      </div>
      <div class="col-50">
         <textarea name="comment"     
            placeholder="Questions/Suggestions/Comments"></textarea>
      </div>
      <p>
         <input class="submit" type="submit" value="Submit" />
      </p>
      </div>
   </fieldset>
</form>
//There have been absolutely NO results and NO error messages.//HTML Form code
<form method="POST" />
   <br>
   <fieldset>
      <div class="col-50">
         <input type="text" name="firstname" placeholder="First Name" 
            required />
      </div>
      <div class="col-50">
         <input type="text"  name="lastname" placeholder="Last Name"  
            required />    
      </div>
      <div class="col-50">
         <input type="number" name="zipcode" minlength="5" 
            maxlength="5" placeholder="Zip Code (where you live)" 
            required />     
      </div>
      <div class="col-50">
         <input type="email" name="email" placeholder="Email" 
            required />    
      </div>
      <div class="col-50">
         <select name="subject" required>
            <option selected hidden value="">Please select the option 
               that best fits your request.
            </option>
            <option value = "guest">I want to be a guest on the 
               podcast.
            </option>
            <option value = "question">I have a question.</option>
            <option value = "suggestion">I have a suggestion.</option>
         </select>
      </div>
      <div class="col-50">
         <textarea name="comment"     
            placeholder="Questions/Suggestions/Comments"></textarea>
      </div>
      <p>
         <input class="submit" type="submit" value="Submit" />
      </p>
      </div>
   </fieldset>
</form>
//There have been absolutely NO results and NO error messages.

Answer 1

考虑到所有注释，以下代码将是一个好的开始。 我不能保证这可以立即使用，但是至少应该向您显示一些错误/警告。 纠正这些错误之后，您还可以放心，进入数据库的数据不会受到SQL注入的攻击。 如果您选择显示用户输入的信息，则仍然必须转义输出。

请注意：

• 错误报告已打开（ 如何显示PHP错误？ ）
• MySQL错误将变成PHP异常（ PDO::ERRMODE_EXCEPTION ）
• 使用PDO +参数化查询（ https://phpdelusions.net ）
• 执行查询后重定向到self ，以便浏览器刷新不会再次发布数据。
• HTML有点清理

---

<?php

// Turn on error reporting
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // Define your connection properties
    $host = 'localhost';
    $db = 'point12_guestform';
    $user = 'root';
    $pass = '';
    $charset = 'utf8mb4';

    // Build up your connection string and set options
    // See this for more info: https://phpdelusions.net/pdo#dsn
    $dsn = "mysql:host=$host;dbname=$db;charset=$charset";
    $options = [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ];

    // Finally, make a connection using PDO.
    // This will throw an exception if something goes awry. 
    $pdo = new PDO($dsn, $user, $pass, $options);

    // Build up your query
    // Notice the query is using placeholders `?` instead of directly
    // injecting user-entered (dangerous) data.
    $sql = 'INSERT INTO aboutpage (firstname,lastname,zipcode,email,subject,comment) VALUES (?,?,?,?,?,?)';
    $stmt = $pdo->prepare($sql);

    // Finally, execute your query by passing in your data. 
    // This is known as a parameterized query and prevents SQL injection attacks
    $stmt->execute([
        $_POST["firstname"],
        $_POST["lastname"],
        $_POST["zipcode"],
        $_POST["email"],
        $_POST["subject"],
        $_POST["comment"]
    ]);

    // Redirect to self, so that a browser refresh doesn't post data again. 
    header('Location: '.$_SERVER['PHP_SELF']);
    exit;
}
?>

<!-- I clean up some of you HTML too. -->
<form method="post">
    <div class="col-50">
        <label>
            <input type="text" name="firstname" placeholder="First Name" required>
        </label>
    </div>


    <div class="col-50">
        <label>
            <input type="text" name="lastname" placeholder="Last Name" required>
        </label>
    </div>

    <div class="col-50">
        <label>
            <input type="number"
                   name="zipcode"
                   minlength="5"
                   maxlength="5"
                   placeholder="Zip Code (where you live)"
                   required/>
        </label>
    </div>

    <div class="col-50">
        <label>
            <input type="email" name="email" placeholder="Email" required>
        </label>
    </div>

    <div class="col-50">
        <label>
            <select name="subject" required>
                <option selected hidden value="">Please select the option
                    that best fits your request.
                </option>
                <option value="guest">I want to be a guest on the
                    podcast.
                </option>
                <option value="question">I have a question.</option>
                <option value="suggestion">I have a suggestion.</option>
            </select>
        </label>
    </div>

    <div class="col-50">
        <label>
            <textarea name="comment" placeholder="Questions/Suggestions/Comments"></textarea>
        </label>
    </div>

    <p>
        <input class="submit" type="submit" value="Submit"/>
    </p>
</form>