php - 使用php上传图片到sql数据库时显示错误

Question

下面的代码将图像上传到我的名为 upload_image 的 SQL 数据库。

if(isset($_POST['submit'])){
$target_path = "images/";
$target_path = $target_path . basename($_FILES['file']['name']);
if(move_uploaded_file($_FILES['file']['tmp_name'], $target_path)){
         $conn =new mysqli("localhost", "root", "", "upload_image");
         $sql = "Insert into upload_image('path') values('$target_path')";
         if($conn->query($sql)==TRUE){
             echo"<br><br>";
         }else{
             echo "Error on upload".$sql.$conn->error;
         }
    }   
}

显示的错误是

Error on uploadInsert into upload_image('path') values('images/ao.png')

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''path') values('images/ao.png')' at line 1

这是 HTML 部分:

<form method="post" enctype="multipart/form-data">
<input type="hidden" value=="1000000" name="MAX_FILE_SIZE"/>
<input type="file" name="file"/>
<input type="submit" name="submit" value="Upload"/>

HTML 和 PHP 都在一个代码中。

Answer 1

线路:

$sql = "Insert into upload_image('path') values('$target_path')";

应该是:

$sql = "Insert into upload_image(path) values('$target_path')";

换句话说，查询中的列名称不应包含引号。

为了可读性:可以对关键字使用大小写

$sql = "INSERT INTO upload_image (path) VALUES ('$target_path')";

为了安全:可以使用准备好的语句

该代码容易受到 SQL 注入(inject)攻击，因此更好的方法是使用准备好的语句，即

$sql = "INSERT INTO upload_image (path) VALUES (?)";
$stmt = $conn->prepare($sql);
$stmt->bind("s", $target_path);
$stmt->execute();