PHP和MySQL-不插入數據庫

Question

我的代碼有問題。 插件不起作用。 代碼如下。

HTML：

<form action="staff.php" method="post" class="center" enctype="multipart/form-data" autocomplete="off">
    <input type="hidden" name="size" value="1000000">
    <input type="text" placeholder="headline of the news" name="title">
    <input type="file" accept="image/*" name="image">
    <select name="side" value="side">
        <option>Left</option>
        <option>Header</option>
        <option>Main</option>
        <option>Ending</option>
    </select>
    <textarea name="desc" id="description" cols="30" rows="10" placeholder="full news" name="desc"></textarea>
    <input type="submit" name="go" value="Post">
</form>

PHP：

<?php
$db = mysqli_connect("DB SERVER", "DB USER", "DB PASS", "DataBase");
$charset = mysqli_set_charset($db,"utf8");
$msg = "";
if (isset($_POST['go'])) {
    $target = "images/".basename($_FILES['image']['name']);
    $title = $_POST['title'];
    $image = $_FILES['image']['name'];
    $side = $_POST['side'];
    $desc = $_POST['desc'];
    $sql = "INSERT INTO contents (title, image, side, description) 
    VALUES ('$title', '$image', '$side', '$desc')";
    $result = mysqli_query($db, $sql);
    if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
        $msg = "<p class='success'>Image uploaded successfully</p>";
    } else {
        $msg = "<p class='error'>There was a problem uploading the image</p>";
    }
}
?>

除了插入數據庫之外，一切都很好。

Answer 1

像這樣在查詢中添加串聯

$sql = "INSERT INTO contents (title, image, side, description) 
        VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

Answer 2

您的查詢很好，應該可以。

但是您允許SQL注入，因此，如果在參數單引號內發送，則查詢將無法按預期工作，並且會拋出錯誤。

您應該先：

• 清除傳遞的字符串（使用mysqli_real_escape_string）， http: //php.net/manual/en/mysqli.real-escape-string.php
• 檢查mysqli_query是否已執行，然后使用mysqli_error找出導致查詢不起作用的錯誤： http : mysqli_error

Answer 3

用於

<?php
$db = mysqli_connect("DB SERVER", "DB USER", "DB PASS", "DataBase") or die(mysqli_error("Could not connect to Database"));
mysqli_query($db,"SET NAMES 'utf8'");
$msg = "";
if (isset($_POST['go'])) {
    $target = "images/".basename($_FILES['image']['name']);

    $title = mysqli_real_escape_string($db,$_POST['title']);
    $image = mysqli_real_escape_string($db,$_FILES['image']['name']);
    $side = mysqli_real_escape_string($db,$_POST['side']);
    $desc = mysqli_real_escape_string($db,$_POST['desc']);
    $sql = "INSERT INTO contents (title, image, side, description) 
    VALUES ('$title', '$image', '$side', '$desc')";
    $result = mysqli_query($db,$sql) or die(mysqli_error($db));
    if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
       $msg = "<p class='success'>Image uploaded successfully</p>";
    }else{
       $msg = "<p class='error'>There was a problem uploading the image</p>";
    }
}
?>

Answer 4

$sql = "INSERT INTO contents VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

這可能是一種較短的方法。

Answer 5

$sql = "INSERT INTO contents (title, image, side, description) VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

問題是在這里使用這個。