javascript - 表单值未插入到我的数据库中

Question

我的表单值打印在这个页面上，但它们没有插入到我的 数据库。我不知道怎么了？如果所有值都在打印 这意味着值到达这个特定页面但没有进入 数据库。即使数据库中的列已排序，但仍然没有 工作。

 <?php
 include("connection.php");
 if(isset($_POST['continue']))
   {
echo $eta_type = $_POST['eta_type'];
echo     $firstname = $_POST['firstname'];
echo      $lastname = $_POST['lastname'];
echo     $title1=$_POST['title1'];
echo    $dob=$_POST['dob'];
echo    $gender=$_POST['gender'];                         
echo   $nationality=$_POST['nationality'];         
echo    $cob=$_POST['cob'];         
echo   $passportnumber=$_POST['passportnumber'];
echo  $pid=$_POST['pid'];                            
echo  $ped=$_POST['ped'];   
echo $residence=$_POST['residence']; 
echo  $possesseta=$_POST['possesseta'];
echo $multipleentry=$_POST['multipleentry'];
echo   $arrivaldate=$_POST['arrivaldate'];
echo   $purpose=$_POST['purpose'];
echo   $final_dest=$_POST['final_dest'];
echo   $stay_days=$_POST['stay_days'];
echo $add1=$_POST['add1'];
echo   $add2=$_POST['add2'];
echo    $city=$_POST['city'];
echo    $state=$_POST['state'];
echo   $pscode=$_POST['pscode'];
echo    $country=$_POST['country'];
echo   $addlanka=$_POST['addlanka'];
echo $email=$_POST['email'];
echo   $alternate_email=$_POST['alternate_email'];
echo   $phone=$_POST['phone'];
echo $mobile=$_POST['mobile'];
echo  $fax=$_POST['fax'];
$date1 = date('Y-m-d', strtotime($dob));
$date2 = date('Y-m-d', strtotime($pid));
$date3 = date('Y-m-d', strtotime($ped));
$date4 = date('Y-m-d', strtotime($arrivaldate));
$address=$add1.$add2;
$sql= "INSERT INTO 
user(applicationtype,
surname,givenname,
title,dob,gender,nationality,
cob,passportnumber,pid,ped,
residenceinsrilanka,processeta,
multipleentryofsrilanka,intentedarrivaldate,
purposeofvisit,finaldestination,staydays,address,
city,state,postalcode,country,addinsrilanka,email,
alternateemail,telephonenos,mobilenos,faxnos) 
VALUES('$eta_type','$lastname','$firstname','$title1',
'$date1','$gender','$nationality','$cob',
'$passportnumber','$date2','$date3','$residence',
'$possesseta','$multipleentry','$date4','$purpose',
'$final_dest','$stay_days','$address','$city',
'$state','$pscode','$country','$addlanka','$email',
'$alternate_email','$phone','$mobile','$fax')";
 $query = mysqli_query($conn, $sql);
 if($query)
    {
      header("Location: continue-to-pay.php?pno=$passportnumber");
    }
    else
    {
        echo "<h4 style='color:red'>Failed.</h4>";
    }
   } 
   ?>

Answer 1

极其危险的代码...

阅读一些关于查询注入(inject)的内容....

以这种方式传递的任何值都可能破坏您的查询。

您需要使用 mysqi_escape_string() 转义您的值

http://php.net/manual/fr/mysqli.real-escape-string.php