duankezong4064 2014-01-13 00:59
浏览 41
已采纳

PHP没有插入表格

I'm having trouble getting a practice signup form to submit data to my database ... 

<!DOCTYPE HTML> 
<html>
<head>
</head>
<body> 

<?php
$name = $email = $password = "";
?>

<form method="post"> 
Name: <input type="text" name="name">
<br><br>
E-mail: <input type="text" name="email">
<br><br>
Password: <input type="text" name="password">
<br><br>
<input type="submit" value="Submit" name="submit">
</form>

<?php
if(isset($_POST['submit'])){
    $name = fix_input($_POST["name"]);
    $email = fix_input($_POST["email"]);
    $password = fix_input($_POST["password"]);
    mysqli_connect("localhost","username","password","dbname") or                 die(mysql_error()); 
    mysql_query("INSERT INTO ('username','password') VALUES ('$name', md5('$password'))"); 
    Print "You've been signed up successfully"; } 


function fix_input($data)
{   
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
?>

</body>
</html>
  • 写回答

4条回答 默认 最新

  • douwei9759 2014-01-13 01:11
    关注

    In addition to Ugur's answer, you are mismatching mysqli commands and mysql commands. Here's how to do this in an object oriented fashion:

    // create mysqli database object
$mysqli = new mysqli_connect("localhost","username","password","database");
// store your query in a variable. question marks are filled by variables
$sql = "INSERT INTO table_name ('username','password') VALUES (?,?)";
// prepare command uses $sql variable as query
$stmt = mysqli->prepare($sql);
// "ss" means your 2 variables are strings, then you pass your two variables.
$stmt->bind_param("ss",$name,md5($password));
// execute does as it seems, executes the query.
$stmt->execute();
// then print your success message here.

    Using prepared statements removes the need to sanitize user input, as harmful input is not substituted into the query directly. For more reading:

    http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php

    There are some good tips for using prepared statements in many different scenarios, as well as towards the bottom, there is an explanation on how prepared statements prevent SQL injection.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(3条)

报告相同问题？

悬赏问题

  • ¥15 chaquopy python 安卓
  • ¥50 Kubernetes&Fission&Eleasticsearch
  • ¥15 CSS实现渐隐虚线框
  • ¥15 有没有帮写代码做实验仿真的
  • ¥15 報錯：Person is not mapped，如何解決？
  • ¥30 vmware exsi重置后登不上
  • ¥15 易盾点选的cb参数怎么解啊
  • ¥15 MATLAB运行显示错误，如何解决？
  • ¥15 c++头文件不能识别CDialog
  • ¥15 Excel发现不可读取的内容