php - 为什么我不写入我的数据库

Question

这是我的代码我做错了什么。我有一个表单提交名称和啤酒名称信息连接到我的数据库。我测试我的连接没有错误。我进行测试以确保定义了变量。最后我尝试写入数据库，但收到此错误:

Warning: mysqli::query() expects parameter 2 to be long, string given
in /home/zacgre4/zachjgreen.dreamhosters.com/Homebrew/contact.php on
line 15.

我的代码是:

if(isset($_POST["name"]) && isset($_POST["beername"])){
    $name = $_POST["name"];
    $beername = $_POST["beername"];
    $host="admin.zachjgreen.dreamhosters.com";
    $un="musicchild";
    $pw="xxxxxxxx";
    $dbn="adminzjg";
    $db=new mysqli($host, $un, $pw, $dbn);
    if($db->connect_errno > 0){
        echo "Failed " . mysqli_connect_error();
    }
    echo $name; 
    echo $beername;
    $db->query($con, "INSERT INTO Beers VALUE ($name, $beername)"); //this is line 15
}

Answer 1

您需要在变量周围加上引号，但这对于 SQL 注入(inject)来说不安全，而且容易出错，您应该准备该查询:

 if(isset($_POST["name"]) && isset($_POST["beername"])){
    $name = $_POST["name"];
    $beername = $_POST["beername"];

    //connection
    $host="admin.zachjgreen.dreamhosters.com";
    $un="musicchild";
    $pw="xxxxxxxx";
    $dbn="adminzjg";


    $db = new mysqli($host, $un, $pw, $dbn);

    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }


    /* create a prepared statement */
    if ($stmt = $db->prepare("INSERT INTO Beers VALUES (?, ?)")) {

        $stmt->bind_param("ss", $name, $beername);
        $stmt->execute();

        printf ("New Record has id %d.\n", $db->insert_id);


        $stmt->close();
    }

    /* close connection */
    $db->close();
}