gpt4 book ai didi

php - 创建将数据发送到数据库的 php 表单时出现问题

转载 作者:行者123 更新时间:2023-11-29 05:11:41 25 4
gpt4 key购买 nike

我是 php 的新手,试图制作这个简单的表格,但我一直在寻找不同的例子来说明如何做,但它们都是用 mysql 完成的,我被告知要切换到 mysqli

<html>
<head>
<title>

</title>
</head>
<body>
<form action="process.php" method="post">
<table>
<tr><th>Student Details</th></tr>
<tr>
<td><label for="student_name">Student Name</label></td>
<td><input type="text" name="student_name" id="student_name"/> </td>
</tr>
<tr>
<td><label for="student_email">Student Email</label></td>
<td><input type="email" name="student_email" id="student_email"/> </td>
</tr>
<tr>
<td><label for="student_city">Student City</label></td>
<td><input type="text" name="student_city" id="student_city"/> </td>
</tr>
<tr>
<td><button name= "submit"type="submit">Submit</button></td>

</tr>

</table>
</form>
</body>
</html>

有人可以看看这段代码并告诉我如何:

A) 避免以下错误:

Undefined variable: insert in C:\Users\CEO\Google Drive\Form\process.php on line 30

Warning: mysqli_query() expects parameter 1 to be mysqli, null given in C:\Users\CEO\Google Drive\Form\process.php on line 30

B) 显然这个表单存在安全风险,我应该添加什么来解决这个问题?

  <?php
$server = 'localhost';
$user = 'root';
$pass = '';
$db = 'college';
$conn = mysqli_connect($server, $user, $pass, $db); //Connect to Database

if(isset($_POST['submit'])){
$name = $_POST['student_name'];
$email = $_POST['student_email'];
$city = $_POST['student_city'];
if($name != "" || $email != "" || $city != ""){
$insert = "INSERT INTO students(student_name, student_email,student_contact) VALUES ('$name','$email','$city')";
$query = mysqli_query($conn,$insert);
echo "Data inserted";
}else{
echo "Failed to insert data";
}
}

if (!mysqli_query($insert, $conn)) {
die('Error: ' . mysqli_error($conn));
}
echo "1 record added";
mysqli_close($conn);

最佳答案

您在 if block 内分配给 $insert。但是随后您尝试在 if block 之外执行查询。因此,如果不满足 if 条件,您仍将尝试调用 mysqli_query(),但使用未初始化的变量。您应该将其移动到 if 中。

if(isset($_POST['submit'])){
$name = $_POST['student_name'];
$email = $_POST['student_email'];
$city = $_POST['student_city'];

if($name != "" || $email != "" || $city != ""){
$insert = "INSERT INTO students(student_name, student_email, student_contact)
VALUES ('$name','$email','$city')";
if (mysqli_query($conn,$insert)) {
echo "Data inserted";
}else{
echo "Failed to insert data: " . mysqli_error($conn);
}
} else {
echo "You have to fill in name, email, or city";
}
}

但是最好使用准备好的语句。

if(isset($_POST['submit'])){
$name = $_POST['student_name'];
$email = $_POST['student_email'];
$city = $_POST['student_city'];

if($name != "" || $email != "" || $city != ""){
$insert = mysqli_prepare("INSERT INTO students(student_name, student_email, student_contact)
VALUES (?, ?, ?)") or die(mysqli_error($conn));
mysqli_stmt_bind_param($insert, "sss", $name, $email, $city);
if (mysqli_stmt_execute($insert)) {
echo "Data inserted";
}else{
echo "Failed to insert data: " . mysqli_error($conn);
}
} else {
echo "You have to fill in name, email, or city";
}
}

关于php - 创建将数据发送到数据库的 php 表单时出现问题,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/38406568/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com