php-将数据插入数据库

Question

当我们谈论PHP时，我是初学者。所以我不知道我在哪里使用PHP犯了错误。

<?php
require "conn.php";
$name = "yolo";
$surname = "yolo";
$nameOfFee= "asd";
$date = '2012-08-06';
$mysql_query = "(INSERT INTO Relation (Person_ID, Fee_ID, Date_of_fee)
SELECT Person.ID,Fee.ID,'$date'
FROM Person,Fee
WHERE Person.Name = '$name' AND Person.Surname = '$surname' AND Fee.Name_of_fee = '$nameOfFee');";

if($conn->query($mysql_query) === TRUE){
    echo "Insert completed";
}
else{
    echo "Insert not completed";
}
$conn->close();
?>

总是认为插入不完整......

Answer 1

问题

您提供的这段代码中存在一些语法错误：

// here it starts, what is this "(" for before insert?
// Take note that your query is vulnerable to SQL attacks
$mysql_query = "(INSERT INTO Relation (Person_ID, Fee_ID, Date_of_fee)
SELECT Person.ID,Fee.ID,'$date'
FROM Person,Fee
WHERE Person.Name = '$name' AND Person.Surname = '$surname' AND Fee.Name_of_fee = '$nameOfFee');";

如何解决

要解决这些问题，我建议您使用MySQLi OOP，就像您现在使用的那样，但添加预准备语句。我将与您一起阅读新代码，以便您了解该过程。

require "conn.php";
$name = "yolo";
$surname = "yolo";
$nameOfFee= "asd";
$date = '2012-08-06';

$sql = "INSERT INTO Relation (Person_ID, Fee_ID, Date_of_fee) VALUES (?, ?, ?)"; // rewrite your query with a preset number of values to prevent SQL Attacks

if($stmt = $conn->prepare( $sql ))
{ // before we run check to make sure the query worked
    $stmt->bind_param('sss', $name, $nameOfFee, $date); // bind your variables so to know what goes where
    $stmt->execute(); // execute the query
    $stmt->close(); // close connection for safety
    // message as an array for the user as feedback.
    $message = array(
        'is_error' => 'success',
        'message' => 'Record was entered into database.'
    );
}
else
{
    $message = array(
        'is_error' => 'danger',
        'message' => 'Query Error, please revise the information.'
    );
}