PHP MYSQL INSERT 不再有效

Question

自从将脚本移至另一台服务器后，我在尝试插入记录时开始遇到以下错误。我该如何解决这个问题？

Warning: mysql_query() expects parameter 1 to be string, resource given in /home/aware/public_html/product_submit.php on line 58

Warning: mysql_query() expects parameter 1 to be string, resource given in /home/aware/public_html/product_submit.php on line 60

Warning: mysql_query() expects parameter 1 to be string, resource given in /home/aware/public_html/product_submit.php on line 61

Warning: mysql_query() expects parameter 1 to be string, resource given in /home/aware/public_html/product_submit.php on line 62

Warning: mysql_query() expects parameter 1 to be string, resource given in /home/aware/public_html/product_submit.php on line 63 product added

代码如下:

<?php
  $page_title = "Aware | Product Submitted";
  include('includes/header.html');
  if (!empty($_POST['code'])) {
      $code = $_POST['code'];
  } else {
      $code = null;
      echo '<p><a href="product_create.php">Enter a product code</a>.</p>';
      exit;
  }
  if (!empty($_POST['pid'])) {
      $pid = $_POST['pid'];
  } else {
      $pid = null;
      echo 'Product ID is not defined.  All SKU information must be linked to a product.';
      exit;
  }
  if (!empty($_POST['sid'])) {
      $sid = $_POST['sid'];
  } else {
      $sid = null;
      echo 'SKU ID is not defined.  All SKU information must be linked to a product.';
      exit;
  }
  if (!empty($_POST['image'])) {
      $image_name = $_POST['image'];
  } else {
      $image_name = null;
      echo '<p>You need to upload a product image!</p>';
  }
  if (!empty($_POST['title'])) {
      $title = $_POST['title'];
  } else {
      $title = null;
      echo '<p>You must enter a product title!</p>';
  }
  if (!empty($_POST['description'])) {
      $description = $_POST['description'];
  } else {
      $description = null;
      echo '<p>You must enter a product description!</p>';
  }
  $material = $_POST['material'];
  $type = $_POST['type'];
  $color = $_POST['color'];
  $image_name = $_POST['image'];
  $bulk = $_POST['bulk'];
  $stock = $_POST['stock'];

  // Connect to the db.
  require_once('mysqli_connect.php');
  // Make the query:
  $product = "INSERT INTO product (code, title, description, image_name, bulk) VALUES ('$code', '$title', '$description', '$image_name', '$bulk')";
  $sku = "INSERT INTO sku (product_idproduct, stock) VALUES ('$pid', '$stock')";
  $material = "INSERT INTO amaterial (sku_idsku, material) VALUES ('$sid', '$material')";
  $type = "INSERT INTO atype (sku_idsku, type) VALUES ('$sid', '$type')";
  $color = "INSERT INTO amcolor (sku_idsku, color) VALUES ('$sid', '$color')";
  $p = mysqli_query($dbc, $product);
  // Run the query.
  $s = mysqli_query($dbc, $sku);
  $m = mysqli_query($dbc, $material);
  $t = mysqli_query($dbc, $type);
  $c = mysqli_query($dbc, $color);
  if ($code && $pid && $title && $description) {
      echo "product added";
 } else {
      // Missing form value.
      echo '<p>Please go back and fill out the form again.</p>';
      exit;
  }
  include('includes/footer.html');
?>

Answer 1

您的代码如下所示:

$p = mysqli_query($dbc, $product);
$s = mysqli_query($dbc, $sku);
$m = mysqli_query($dbc, $material);
$t = mysqli_query($dbc, $type);
$c = mysqli_query($dbc, $color);

但是，这不是提示的代码——错误表明这是 mysql_query 的问题，而不是您代码中的 mysqli_query。

我的直觉是，您正在寻找与实际运行的代码不同的版本——即您认为您在代码中使用了 mysqli_query，但实际代码在服务器有 mysql_query。

这两个函数，除了由于函数名称中只有一个字符而容易混淆之外，还需要一组不同的参数。如果您的代码使用的是 mysqli_query，那么它是正确的，但是如果您删除了“i”并且实际上是在使用 mysql_query，那么这个错误是有道理的，因为 mysql_query 期望查询字符串是第一个参数。

混合和匹配这两者通常不是一个好主意 - 您应该使用 mysql_xx 函数或 mysqli_xx，但不能同时使用。确保您的代码是一致的，并且只使用一个或另一个。

我也赞同@eykanal 关于您的代码容易受到 SQL 注入(inject)攻击的评论。您应确保查询字符串中的所有变量都已正确转义。