php - 将 php 中的数据发送到 SQL、数据库时遇到问题

Question

这是一段代码，其中一些行被注释掉了。如果我使用所有文字(而不是变量)发送一个案例，它似乎可以工作，但是当我抛出“. $uid .”和其中的其他人时，它不起作用。每次使用后我都会检查数据库以查看。

 <?php // working name and pics
        if ($user) {
        echo "Hello test";
        $arrayOfFriends = $facebook->api('/me/friends');
        foreach ($arrayOfFriends['data'] as $value) {
        $uid = $value['id'];
        $name = $value['name'];
        echo $name;
        //create the url
        $profile_pic =  "http://graph.facebook.com/".$uid."/picture?type=large";
        //echo the image out
        echo "<img src=\"" . $profile_pic . "\" />"; 
        echo "<br>";
            //put uid, name, and link to pic in data base 
            // Check connection
            if (mysqli_connect_errno())
            {
                echo "Failed to connect to MySQL: " . mysqli_connect_error();
            } else {
                echo "MySQL connects" ;
            }
            //$command = "INSERT INTO  `peoplestorage` (  `ID` ,  `UID` ,  `name` ,  `piclink` ,  `scoop1` ,  `scoop2` ,  `scoop3` ) VALUES ( '' ,".$uid.",".$name.",".$profile_pic.",'','','')";
            //$command = "INSERT INTO  `peoplestorage` (  `ID` ,  `UID` ,  `name` ,  `piclink` ,  `scoop1` ,  `scoop2` ,  `scoop3` ) VALUES ('' ,  '444567',  'hoop22',  'link to poictiure ',  'hero',  'big ol',  '')";
            //echo $command;
            mysqli_query($link, "INSERT INTO  `peoplestorage` (  `ID` ,  `UID` ,  `name` ,  `piclink` ,  `scoop1` ,  `scoop2` ,  `scoop3` ) VALUES ( '' ,".$uid.",".$name.",".$profile_pic.",'','','')");

        }   


            //testing inputting data 

            //$result = mysqli_query($link, "SELECT * FROM  `peoplestorage` LIMIT 0 , 30");
            //while($row = mysqli_fetch_array($result))
            //{
            //echo $row['ID'] . " " . $row['name'];
            //echo "<br>";
            //}


        }
    ?> 

Answer 1

你应该研究参数化查询，这将否定这个问题。

您的问题源于您没有引用变量字符串这一事实。

mysqli_query($link, "INSERT INTO  `peoplestorage` (  `ID` ,  `UID` ,  `name` ,  `piclink` ,  `scoop1` ,  `scoop2` ,  `scoop3` ) VALUES ( '' ,'".$uid."','".$name."','".$profile_pic."','','','')");