获取url参数并插入数据库

Question

Trying to insert into database by typing the value in the url, but having difficulties to insert into the database:

Here is the URL:

http://student.cs.hioa.no/~s180343/updatedb.php?verdi=22

Here is the code:

<?php

$dbhost = "MYSQL-SERVER";
$dbuser = "USERNAME";
$dbpass = "";
$verdi = $_GET['verdi'];

$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
  die('Could not connect: ' . mysql_error());
}
$sql = "INSERT INTO test ('id') VALUES (`$verdi`)";

mysql_select_db('s180350');
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
  die('Could not enter data: ' . mysql_error());
}
echo "Entered data successfully
";
mysql_close($conn);
?>

Answer 1

You are doing reverse i.e. adding '' for column name and `` for the value

$sql = "INSERT INTO test ('id') VALUES (`$verdi`)";

should be

$sql = "INSERT INTO test (`id`) VALUES ('$verdi')";

Start using prepare statement or at least below after conn is defined.

$verdi = mysql_real_escape_string($verdi);