php from 向 mysql 数据库表插入一行

Question

我正在尝试获取用户输入以在表中添加一行，但似乎 $_post 在第二页不再起作用，我该怎么做？我希望用户能够自己添加、删除、更新值。非常感谢大家的帮助

这是我的第一页:

<?php
$servername = "localhost";
$username = "";
$password = "";
$dbname = "";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 
$sql = "SELECT * FROM entree";
$result = $conn->query($sql);
echo "<table border='1'>
<tr>
<th>entree id</th>
<th>entree name</th>
<th>price</th>
<th>spicy</th>
</tr>";

while($row = mysqli_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['e_id'] . "</td>";
echo "<td>" . $row['ename'] . "</td>";
echo "<td>" . $row['price'] . "</td>";
echo "<td>" . $row['spicy'] . "</td>";
echo "</tr>";
}
echo "</table>";
mysqli_close($con);
?>
<form action="addrow.php" method="post">
    to make any change of this table, please fill in parts you needs.<br><br>
    To add a new row: please enter:<br>
    Entree ID: <input type="input" name="e_id"> 
    Entree Name: <input type="input" name="ename">
    Price: <input type="input" name="price">
    Spicy: <input type="input" name="spicy">
    <br>
    <input type="submit" value="add">
</form>

这是我的第二页:

<?php
$servername = "localhost";
$username = "";
$password = "";
$dbname = "";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$sql = "INSERT INTO entree (e_id, ename, price, spicy)
VALUES ('$_POST["e_id"]', '$_POST["ename"]', '$_POST["price"]', '$_POST["spicy"]')";

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}
$conn->close();
?>

Answer 1

您正在将“””嵌套在

中

$sql = "INSERT INTO entree (e_id, ename, price, spicy) VALUES ('$_POST["e_id"]', '$_POST["ename"]', '$_POST["price"]', '$_POST["spicy"]')";

这还引入了一个很大的安全漏洞 - sql 注入(inject)。请改用命名参数。这将解决两个问题。

how to bind multiple parameters to MySQLi query