php - mysqli_query() 生成查询错误

Question

这个问题已经有答案了:

Syntax error due to using a reserved word as a table or column name in MySQL (1 个回答)

How can I prevent SQL injection in PHP? (27 个回答)

已关闭 5 年前。

我正在尝试使用 mysqli 将表单数据存储到数据库中，但它生成查询错误，我的代码如下......当我尝试提交数据库连接时，正在生成.. $_POST 工作正常.. 错误仅由 mysqli_query 生成..

<?php 
$name = $_POST["firstname"] . " " . $_POST["lastname"];
$email = $_POST["email"];
$happen = $_POST["whendidhappen"];
$howlong = $_POST["howlong"];
$howmany = $_POST["howmany"];
$describe = $_POST["describe"];
$whattheydid= $_POST["whattheydid"];
$seenmycat = $_POST["seenmycat"];
$anythingelse = $_POST["anythingelse"];


$dbc = mysqli_connect('localhost','root','','abductionreport') 
or die('Database connection error');


$query = "INSERT INTO abductionform (firstname, lastname, email,whendidhappen, howlong, describe, whattheydid, seenmycat,anythingelse)VALUES('$name','$name','$email','$happen','$howlong', '$howmany','$describe','$whattheydid', '$seenmycat','$anythingelse')";



$result = mysqli_query($dbc,$query) or die ("Query Error");

mysqli_close($dbc); 



?>
<h3>Aliens Abducted Me - Report an Abduction</h3>
<p>Thanks for Submiting the form.</p>
<?php 
echo "$name it happend to you on $happen it take $howlong <br>";
echo "Number of aliens: $howmany<br>";
echo "Describe: $describe<br>";
echo "What they did to you: $whattheydid<br>";
echo "Have you seen my cat: $seenmycat<br>";
echo "Anything else : $anythingelse<br>";
echo "Your Email Address is : $email<br>";

?>

Answer 1

DESCRIBE 是 mysql 关键字。将列名称用反引号括起来。为此，请用反引号将表格和所有列括起来。在尝试访问 $_POST 元素之前，请务必使用 isset () 检查它们是否存在。使用带有占位符的 mysqli 准备语句以提高安全性。在发布到 SO 之前始终执行错误检查。

您的查询中还有 9 列和 10 个值 - 这每次都会导致失败。