PHP 表单不将数据保存到 MySQL 数据库

Question

我创建了一个简单的表单来为我正在开发的系统创建新用户，但由于某种原因，在处理表单时，“密码”字段没有存储在数据库中，或者至少看起来是这样因为表中的其余字段都已填写在“密码”字段中。

表单代码如下:

<form action="create_admin.php" method="post" enctype="multipart/form-data">
        <div style="float:left; width:45%">

        <!-- username -->           

        <p>
            <label>Username:</label><br/>
            <input type="text" class="text small" name="username" id="username" value="" />
                <span class="note">*required</span>

        </p>

        <!-- password -->

        <p>
            <label>Password:</label><br/>
            <input type="text" class="text small" name="password" id="password" value="" />
                <span class="note">*required</span>
        </p>


        <!-- other comments -->                 
            </div>

        <div style="width:45%;float:right">
        <!-- user_id_account -->

        <p>
            <label>Position:</label><br/>
                <select name="position" class="styled" style="width:240px">
                    <option value="0">n/a</option>
                    <option value="Design"  >Design</option>
                    <option value="Development"  >Development</option>
                    <option value="Sales"  >Sales</option>
                    <option value="Management"  >Management</option>                        
                </select>
        </p>

    </div>  


        <p>
            <input type="submit" class="submit long" value="Save and Return" name="submit" />
        </p>

     </form>

表单处理代码如下:

<?php require_once("includes/db_connection.php"); ?>
<?php require_once("includes/functions.php"); ?>

<?php
if (isset($_POST['submit'])) {
    //Process the form
$username = mysql_prep($_POST["username"]);
$password = $_POST["password"];
$position = $_POST["position"];

$query  = "INSERT INTO admin (";
$query .= " username, password, position";
$query .= " ) VALUES (";
$query .= " '{$username}', '{$password}', '{$position}' ";
$query .= ")";

echo $query;

try { $result = mysqli_query($connection, $query);
} catch (Exception $e) {
    return 'Caught exception: '+  $e->getMessage()+ "\n";
}
//Test if there was a query error
if ($result) {
    //Success
    // would normally use a redirect ie redirect_to("somepage.php");
    //$message = "Subject created.";
    redirect_to("list_admins.php");
}else {
    //failure
    //$message = "Subject creation failed.";
    //redirect_to("add_project.php");
    echo $query;
}
} else {
// This is probably a GET request
redirect_to("add_admin.php");
}?>

<?php
// Close database connection
if(isset($connection)){ mysqli_close($connection); }
?>

我认为问题可能出在我的 SQL 语句上，但我已经在 phpMyAdmin 中尝试过，看起来没问题。任何人都可以阐明我在这里可能会出错的地方吗？

*注意:我意识到我还没有将密码输入设置为密码，因为我只想暂时将其保存为纯文本，直到一切正常运行并在稍后阶段为其添加加密。

Answer 1

你的 try-catch block 不会抛出任何东西。尝试这样的方法来正确插入您的插入物。另请注意，如果您在之前回显，则无法重定向。

$query  = "INSERT INTO admin ( username, password, position ) VALUES ( ?, ?, ? )";

echo $query;  // <-- If you echo this, your php redirect won't work, unless you use Javascript

if($stmt = $connection->prepare($query)){
    $stmt->bind_param('sss', $username, $password, $position);
    $result = $stmt->execute();
    $stmt->close();
}else die("Failed to prepare!");