PHP + MySQL "INSERT INTO"错误

Question

我有这个 sql 字符串:

$sql = "INSERT INTO foto (id, nome, check)
            VALUES ('', '" . md5($file) . '.' .$Type. "', '" . md5($file2) . '.' .$Type2. "')";

但它返回这个错误:

INSERT INTO foto (nome, check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9b79a9a224865.jpg')
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9' at line 1

'

md5($file) + $Type = 57f030f902b9fbd6907d1af52ec2a1ba.jpg
md5($file2) + $Type2 = 8c96b1254a72dbd080a9b79a9a224865.jpg

有什么问题？我该如何解决？

Answer 1

check是MySQL保留字

• http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

这要求它用反引号括起来，或者在您的表格中将其重命名为 checks。

$sql = "INSERT INTO foto (id, nome, `check`)

如果你想重命名它，那么就这样做

$sql = "INSERT INTO foto (id, nome, checks)

不会抛出错误；选择权在你。

---

注意错误从哪里开始并指向:

>...MySQL server version for the right syntax to use near 'check                                                          ^ starts there

---

此外，一旦您修复了该问题，您的代码仍将对 SQL injection 开放.
使用 mysqli with prepared statements , 或 PDO with prepared statements ，它们更安全。