php - 无法定位php中的sql错误

Question

我收到的错误消息

Parse error: syntax error, unexpected 'INTO' (T_STRING) in D:\ServerFolders\Web\tokens\insert.php on line 17

第 17 行

$sql= INSERT INTO users(Forename, Surname, Email, Username, Password, DOB) 

完整代码

    <?php
//Connect to DB
$con=mysql_connect(localhost,root, "",APROJECT) or die (mysql_error());
// Check connection
if (mysql_connect_errno()) {
 echo "Failed to connect to MySQL: " . mysql_connect_error();
}

// escape variables for security
$Forename = mysql_real_escape_string($con, $_POST['Forename']);
$Surname = mysql_real_escape_string($con, $_POST['Surname']);
$Email = mysql_real_escape_string($con, $_POST['Email']);
$Username = mysql_real_escape_string($con, $_POST['Username']);
$Password = mysql_real_escape_string($con, $_POST['Password']);
$DOB = mysql_real_escape_string($con, $_POST['DOB']);
//SQL query to add data to DB
$sql= INSERT INTO users(Forename, Surname, Email, Username, Password, DOB) 
VALUES ($Forename, $Surname, $Email, $Username, $Password, $DOB);

if (!mysql_query($con,$sql)) {
  die('Error: ' . mysql_error($con));
}
echo "1 record added";

mysql_close($con);
?>

Answer 1

首先，不再支持 mysql_*，建议使用 PDO 或 mysqli_* 代替。

您应该将查询放入引号中；

$sql= "INSERT INTO users(Forename, Surname, Email, Username, Password, DOB) 
VALUES ($Forename, $Surname, $Email, $Username, $Password, $DOB)";

这可能行不通!因为您必须将值放入单引号中。所以更好的方法是使用参数化查询。

仅这一次我建议使用 sprintf() 函数。

$sql= sprintf("INSERT INTO users(Forename, Surname, Email, Username, Password, DOB) 
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s')", $Forename, $Surname, $Email, $Username, $Password, $DOB);