dssqq82402 2018-07-29 20:25
浏览 36
已采纳

尝试将表单值发送到数据库

i have a problem in sending my form values to mysql database i readed all other topics and i did what they wrote but i didn't get what i want please help me :(

        <?php
      $dbhost = "localhost";
      $dbuser = "root";
      $dbpass = "13838383";
      $dbname = "users";
      $connection = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);
    ?>
    <?php
    include("../includes/functions.php");
    ?>
    <!DOCTYPE html>
    <html>
      <head>
        <link rel="stylesheet" href="../public/stylesheets/style.css" type="text/css">
        <title>Our WebPage</title>
      </head>
      <body>
        <center>
        <form action="input.php" method="post">
          <fieldset>
            <legend>Register</legend>
            <span>UserName: </span><br />
            <input type="text" name="username" placeholder="USERNAME"><br /><br />
            <span>PassWord: </span><br />
            <input type="text" name="lastname" placeholder="PASSWORD"><br /><br />
            <input type="button" name="submit" value="submit"><br /><br />
            <fieldset>
        </form>
        </center>
        <?php
        ?>
        <?php
          if (isset($_POST['submit'])) {
            $username = $_POST['username'];
            $password = $_POST['password'];
            $addUserQuery = "INSERT INTO users (username, password) VALUES ({$username}, {$password});";
            $added = mysqli_query($connection, $addUserQuery);
            if ($added) {
              echo '<br>Input data is successful';
            } else {
              echo '<br>Input data is not valid';
            }
          }
        ?>
      </body>
    </html>

and my problem is i don't know know what should i enter in action attribute in form tag thanks please help

  • 写回答

1条回答 默认 最新

  • douxian1770 2018-07-29 20:28
    关注

    Simply put, your variables aren't quoted, so your query is being turned into this (If someone submitted 1337user as the username, and P@ssw0rd as the password):

    INSERT INTO users (username, password) VALUES (1337user, P@ssw0rd);
    

    When it should be:

    INSERT INTO users (username, password) VALUES ('1337user', 'P@ssw0rd');
    

    Bind your variables instead: How can I prevent SQL injection in PHP?

    if (isset($_POST['submit'])) {
        $username = $_POST['username'];
        $password = $_POST['password'];
        $addUserQuery = mysqli_prepare($connection, "INSERT INTO users (username, password) VALUES (?, ?)");
        mysqli_stmt_bind_param($addUserQuery, "ss", $username, $password);
        $added = mysqli_stmt_execute($addUserQuery);
        if ($added) {
          echo '<br>Input data is successful';
        } else {
          echo '<br>Input data is not valid';
        }
    }
    
    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 可见光定位matlab仿真
  • ¥15 arduino 四自由度机械臂
  • ¥15 wordpress 产品图片 GIF 没法显示
  • ¥15 求三国群英传pl国战时间的修改方法
  • ¥15 matlab代码代写,需写出详细代码,代价私
  • ¥15 ROS系统搭建请教(跨境电商用途)
  • ¥15 AIC3204的示例代码有吗,想用AIC3204测量血氧,找不到相关的代码。
  • ¥20 CST怎么把天线放在座椅环境中并仿真
  • ¥15 任务A:大数据平台搭建(容器环境)怎么做呢?
  • ¥15 YOLOv8obb获取边框坐标时报错AttributeError: 'NoneType' object has no attribute 'xywhr'