php - 查询中的 mySQLi 语法错误

Question

我正在处理用户注册表单，但遇到了 mysql 语法错误，但我不知道为什么。

$username =  mysqli_real_escape_string($con, $_POST['username']);
$email =  mysqli_real_escape_string($con, $_POST['email']);
$password =  md5(mysqli_real_escape_string($con, $_POST['password']));
$key = md5(rand(1, 1000));
$q = "INSERT INTO users (username, email, password, confirmed, key) 
      VALUES ('$username', '$email', '$password', 0, '$key')";

mysqli_query($con, $q) or die(mysqli_error($con)." Q=".$q);

这不是连接问题，因为工作正常。它给了我这个错误:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL 
server version for the right syntax to use near 'key) VALUES ('jirikrewinkel',   
'jiri@mail.com', '29940b146d722a311446ca2d68f9739d' at line 1 

Q=INSERT INTO users (username, email, password, confirmed, key) VALUES 'jirikrewinkel',
'jiriaesthetics@gmail.com', '29940b146d722a311446ca2d68f9739d', 0,
'd64a340bcb633f536d56e51874281454')

Answer 1

你需要逃脱reserved words in MySQL就像带有反引号的key

INSERT INTO users (username, email, password, confirmed, `key`) ...
                                here---------------------^---^

一般来说，您可以在错误消息中看到问题所在。错误消息中第一个出现的词就是问题所在。

You have an error in your SQL syntax; check the manual ... for the right syntax to use near 'key)