javascript - 日期未在数据库中保存正确的值

Question

我正在获取当天和今天的年份和月份，并在我的文本框中显示正确的值。但是，当我开始将其提交到数据库时，该值默认变为 2014 而不是文本框的值。似乎是什么问题？

function YearMonth() {
  var d = new Date();
  var n = d.getFullYear();
  var t = d.getUTCMonth()+1;
  var x = n + "-" + t ;
  
  document.getElementById("num").value = x;
}

 <td><input type="text" id="num" name="num"></td></tr>
 
<input type= "button" name= "button_go" onclick="YearMonth()" id= "button_go" value= "GO" /> 
<input type= "submit" name= "submit" id= "submit_form" value= "Submit" />

<?php
    $servername = "localhost";
    $username = "root";
    $password = "";
    $dbname = "_db";
        $connection = new mysqli($servername, $username, $password, $dbname);

            if ($connection->connect_error) {
                die("Connection failed: " . $connection->connect_error);
            }       

$count = $_POST['num'];

       $sql = "INSERT INTO table (no)
            VALUES ($count)";

            if ($connection->query($sql) === TRUE) 
            {

            } 
            else
            {
                echo "Error: " . $sql . "<br>" . $connection->error;
            }

Answer 1

您的问题出在您的INSERT 查询中:

$sql = "INSERT INTO table (no) VALUES ($count)";

因为您没有引用 $count，所以这会转换为

INSERT INTO table (no) VALUES (2019-5)

然后 MySQL 将其转换为

INSERT INTO table (no) VALUES (2014)

在 $count 周围添加引号将暂时解决您的问题:

$sql = "INSERT INTO table (no) VALUES ('$count')";

但是你真的应该切换到准备好的语句来避免 SQL 注入(inject)风险。像这样的东西:

$stmt = $connection->prepare("INSERT INTO table (no) VALUES (?)");
$stmt->bind_param('s', $count);
$stmt->execute();

如果您最初使用准备好的语句，您一开始就不会遇到这个问题。