Question

PHP脚本：

<?php
include('connect.php');

if (isset($_POST['project_name'])){
    $name = $_POST['project_name'];
    $date = $_POST['date'];
    $amount = $_POST['amount'];
    $curr = $_POST['curr'];
    $spec = $_POST['spec'];
    $SQL = "INSERT INTO projects (name, date, currency, amount, specifications) VALUES '$name','$date','$amount','$curr','$spec'" or die(mysql_error()."update failed");
    $insert = mysql_query($SQL);    
    if($insert){
echo "Successful";
echo "<BR>";
echo "<a href='insert.php'>Back to main page</a>";
} else {
?>
A HTML FORM HERE
<?php
}
?>

注意：connect.php文件工作正常，因为我之前在其他脚本上使用过它，但是在同一台服务器上。

每次我尝试提交表单（method = post）时，都会收到此错误消息： You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''sad','08/13/2013','244','dollars','sdasd'' at line 1 32767

可能是什么问题？

Answer 1

INSERT INTO projects (name, date, currency, amount, specifications) VALUES( '$name','$date','$amount','$curr','$spec'")

在值

之后添加(

Answer 2

插入时，给定行的VALUES必须括在括号中。

INSERT INTO projects (name, date, currency, amount, specifications) VALUES  
    ('$name','$date','$amount','$curr','$spec')

为了记住这一点，您只需记住INSERT允许添加几个行，这就是为什么每个行必须由这些括号分隔：

-- Just for the example, insert 3 time the same row
INSERT INTO projects (name, date, currency, amount, specifications) VALUES
    ('$name','$date','$amount','$curr','$spec'),
    ('$name','$date','$amount','$curr','$spec'),
    ('$name','$date','$amount','$curr','$spec');

顺便说一句，请注意，使用字符串插值来构建查询是SQL注入的主要风险。有关详细信息，请参阅How can I prevent SQL injection in PHP?。

Answer 3

您忘记了(＆amp;插入语句中的)：

 $SQL = "INSERT INTO projects (name, date, currency, amount, specifications) 
         VALUES 
        ('$name','$date','$amount','$curr','$spec')" or die(mysql_error()."update failed");

我尝试插入值时第1行的MySQL错误

3 个答案: