PHP Mysql 提交表单

Question

我正在尝试使用 php 将 html 表单中的数据提交到 sql 数据库。它已完成第 5 部分，但除了自动增量用户 ID 之外，任何表行中似乎都没有任何实际数据。另外，这段代码是否受到 SQL 注入(inject)的保护？另外，将日期戳输入 SQL 数据库的最佳方法是什么？例如 ClientSince 字段。

这是我的 clientsubmit.php

<?php
// Create connection
echo "Made it! Part 1";
$con=mysqli_connect("xxx","xxx","xxx","xxx");
echo "Made it! Part 2";
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
$txtNam = mysql_real_escape_string($_POST["name"]);
$txtEmail = mysql_real_escape_string($_POST["email"]);
$txtSlots = mysql_real_escape_string($_POST["slotcount"]);
$txtSecurity = mysql_real_escape_string($_POST["passcode"]);
echo "Made it! Part 3";
$sql = "INSERT INTO accounts (name, email, slotCount, securityCode)     Values('$txtNam','$txtEmail','$txtSlots','$txtSecurity')";
echo "Made it! Part 4";
if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }


echo "Made it! Part 5";

mysqli_close($con);
?>

这是我的表格:

<form name="form" class="form" action="clientsubmit.php" method="post">
<input type="text" name="sum2" readonly hidden="true" onChange="updatesum()"     value="1.5"/><br>
Ingame Name: <input type="text" name="name" class="txtbox" /><br><br>
Email Address: <input type="text" name="email" class="txtbox" /><br><br>
Passcode: <input type="text" name="passcode" class="txtbox2" /><br><br>
Slot Count:  <input type="text" name="slotcount" onChange="updatesum()" class="txtbox2"     value="10"/><br><br>
Per Month:  <input name="sum" readonly class="txtboxtotal" style="border: 0px;"     value="15"> Million<br><br>
<input type="submit">
</form>

添加了这些:

echo "Made it here! 3 ";
echo "   ";
echo $txtNam;
echo "   ";
echo $txtEmail;
echo "   ";
echo $txtSlots;
echo "   ";
echo $txtSecurity;
echo "   ";

看起来变量在提交到数据库之前没有保存任何数据。

在你们的帮助下，它可以工作了，这是完成的代码:

<?php
// Create connection
$con=mysqli_connect("xxxx","xxxx","xxxx","xxxx");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  die();
  }
$txtNam = mysqli_real_escape_string($con, $_POST["name"]);
$txtEmail = mysqli_real_escape_string($con, $_POST["email"]);
$txtSlots = mysqli_real_escape_string($con, $_POST["slotcount"]);
$txtSecurity = mysqli_real_escape_string($con, $_POST["passcode"]);
$sql = "INSERT INTO accounts (name, email, slotCount, securityCode)     Values('$txtNam','$txtEmail','$txtSlots','$txtSecurity')";
if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }

mysqli_close($con);
?>

Answer 1

问题是您正在使用mysql_real_escape_string()并使用mysqli_*()

将mysql_real_escape_string()更改为mysqli_real_escape_string()

$txtNam = mysqli_real_escape_string($con, $_POST["name"]);
$txtEmail =  mysqli_real_escape_string($con,$_POST["email"]);
$txtSlots = mysqli_real_escape_string($con,$_POST["slotcount"]);
$txtSecurity = mysqli_real_escape_string($con,$_POST["passcode"]);