duansha7453 2014-09-13 16:53
浏览 126
已采纳

创建表单并将数据存储在数据库中

I am creating simple form that accepts input from user and stores that data into database.......but I am getting the following error..I've tried many solutions..bt not single works!! Plz help me..

Here's My code..club.php 

<!DOCTYPE HTML>
<html>
<head>
<link rel="stylesheet" type="text/css" href="clubcs.css">
<title>Friends Club Registration</title>
</head>
<body>
<form action="insert.php" method="post">
<div style="text-align:center;">
<img src="logo.jpg" alt="img" height="200">
</div>
<div class="segment_header" style="width:auto;text-align:Left;">
   <h1 style="font-size:23px;">New Member Registration</h1>
</div>
<div class="text_field">
<p>First Name:<input type="text" name="first"></p>
<p>Last Name:<input type="text" name="last"></p>
<p>Address:<input type="text" name="addr"></p>
<p>City:<input type="text" name="city"></p>
<p>Contact no.:<input type="text" name="contact"></p>
<p><input type="submit"></p>
</div>
</form>
</body>
</html>

and insert.php 

<?php
$con=mysqli_connect("localhost","root","");
if (!$con)
{
die('Could not connect: ' . mysqli_error($con));
}
mysqli_select_db($con,"clubinfo");
$first=mysqli_real_escape_string($con,isset($_POST['first']));
$last=mysqli_real_escape_string($con,isset($_POST['last']));
$addr=mysqli_real_escape_string($con,isset($_POST['addr']));
$city=mysqli_real_escape_string($con,isset($_POST['city']));
$contact= mysqli_real_escape_string($con,isset($_POST['contact']));
$sql1="INSERT INTO clubdata (FirstName, LastName, Address, City, Contact no.)
VALUES ('$first', '$last', '$addr', '$city', '$contact')";
if (!mysqli_query($con,$sql1))
{
die('Error: ' . mysqli_error($con));
}
echo "You have successfully registered with us!";
mysqli_close($con);
?>
  • 写回答

2条回答 默认 最新

  • dsen53898 2014-09-13 16:55
    关注

    The error (unshown in your question) is based on this Contact no. being your column.

    First, it contains a space and a period. If that is your actual column name, you should consider renaming it to Contact_no or use backticks around it.

    I.e.:

    `Contact no.`

    or removing the period and rename it to (and in your DB):

    `Contact no`

    change to

    (FirstName, LastName, Address, City, `Contact no.`)

    or remove the period and rename it in DB to Contact no

    (FirstName, LastName, Address, City, `Contact no`)

    or rename it in your DB to Contact_no with an underscore

    (FirstName, LastName, Address, City, Contact_no)

    using that type of naming convention is not considered good practice. MySQL will complain about it.

    For more information on table/column indentifiers, visit the MySQL.com website:

    Also, remove all the isset from your variables.

    $first=mysqli_real_escape_string($con,$_POST['first']);

    etc.

    You may also be injecting characters that MySQL does not agree with, apostrophes, slashes etc.. Using only mysqli_real_escape_string is not sufficient. Add stripslashes()

    I.e.:

    $first=stripslashes($_POST['first']);
$first=mysqli_real_escape_string($con,$_POST['first']);

    etc.

    Using prepared statements would be easier to use.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(1条)

报告相同问题？

悬赏问题

  • ¥15 没有证书，nginx怎么反向代理到只能接受https的公网网站
  • ¥50 成都蓉城足球俱乐部小程序抢票
  • ¥15 yolov7训练自己的数据集
  • ¥15 esp8266与51单片机连接问题(标签-单片机|关键词-串口)（相关搜索：51单片机|单片机|测试代码）
  • ¥15 电力市场出清matlab yalmip kkt 双层优化问题
  • ¥30 ros小车路径规划实现不了，如何解决？(操作系统-ubuntu)
  • ¥20 matlab yalmip kkt 双层优化问题
  • ¥15 如何在3D高斯飞溅的渲染的场景中获得一个可控的旋转物体
  • ¥88 实在没有想法，需要个思路
  • ¥15 MATLAB报错输入参数太多