duankezong4064 2014-01-12 16:59
浏览 41
已采纳

PHP没有插入表格

I'm having trouble getting a practice signup form to submit data to my database ...

<!DOCTYPE HTML> 
<html>
<head>
</head>
<body> 

<?php
$name = $email = $password = "";
?>

<form method="post"> 
Name: <input type="text" name="name">
<br><br>
E-mail: <input type="text" name="email">
<br><br>
Password: <input type="text" name="password">
<br><br>
<input type="submit" value="Submit" name="submit">
</form>

<?php
if(isset($_POST['submit'])){
    $name = fix_input($_POST["name"]);
    $email = fix_input($_POST["email"]);
    $password = fix_input($_POST["password"]);
    mysqli_connect("localhost","username","password","dbname") or                 die(mysql_error()); 
    mysql_query("INSERT INTO ('username','password') VALUES ('$name', md5('$password'))"); 
    Print "You've been signed up successfully"; } 


function fix_input($data)
{   
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
?>

</body>
</html>

展开全部

  • 写回答

4条回答 默认 最新

  • douwei9759 2014-01-12 17:11
    关注

    In addition to Ugur's answer, you are mismatching mysqli commands and mysql commands. Here's how to do this in an object oriented fashion:

    // create mysqli database object
    $mysqli = new mysqli_connect("localhost","username","password","database");
    // store your query in a variable. question marks are filled by variables
    $sql = "INSERT INTO table_name ('username','password') VALUES (?,?)";
    // prepare command uses $sql variable as query
    $stmt = mysqli->prepare($sql);
    // "ss" means your 2 variables are strings, then you pass your two variables.
    $stmt->bind_param("ss",$name,md5($password));
    // execute does as it seems, executes the query.
    $stmt->execute();
    // then print your success message here.
    

    Using prepared statements removes the need to sanitize user input, as harmful input is not substituted into the query directly. For more reading:

    http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php

    There are some good tips for using prepared statements in many different scenarios, as well as towards the bottom, there is an explanation on how prepared statements prevent SQL injection.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(3条)
编辑
预览

报告相同问题?

手机看
程序员都在用的中文IT技术交流社区

程序员都在用的中文IT技术交流社区

专业的中文 IT 技术社区,与千万技术人共成长

专业的中文 IT 技术社区,与千万技术人共成长

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

客服 返回
顶部