duan0714 2015-01-21 23:26
浏览 44
已采纳

MySQL从PHP运行时显示SQL语法错误

I am trying to create a dynamic page and store it in a MySQL database. It connects to the database fine, but there seems to be an error in the SQL Syntax that I can't find. I've tried reformatting the code and cannot pin point it. Here's the PHP:

<!DOCTYPE html>
<html>
    <head lang="en">
        <meta charset="UTF-8">
        <title></title>
    </head>
    <body>
        <?php
            $dbc = mysqli_connect('localhost', 'username', 'password', 'test_db')
            or die("There was an error connecting to the database. Please try again later.");

            $fullname = (string)$_POST['name'];
            $guest_email = $_POST['email'];
            $password = $_POST['password'];
            echo "<h1>Thanks for your submission!</h1>";
            echo "Your Name on File is: ". $fullname . '<br>';
            echo "Your Email on File is: ". $guest_email . '<br>';
            echo "Your Password on File is: ". $password . '<br>';

            $add_query = "INSERT INTO test_form (full_name, email, user_pass) VALUES( $fullname, $guest_email, $password)";

            $result = mysqli_query($dbc, $add_query)
            or die("<strong>There was an error processing the form. Please call your IT support!</strong>". mysqli_error($dbc));

            mysqli_close($dbc);
        ?>
    </body>
</html>

And here's the HTML:

<!DOCTYPE html>
<html>
    <head lang="en">
        <meta charset="UTF-8">
        <title>Test Form</title>
    </head>
    <body>
        <h1>Test Form</h1>
        <form action="index.php" method="post">
            <input type="text" placeholder="Name" name="name"/>
            <input type="email" name="email" id="email" placeholder="Email"/>
            <input type="password" name="password" id="password" placeholder="Enter a password"/>
            <input type="submit" value="Submit"/>
        </form>
    </body>
</html>
  • 写回答

3条回答 默认 最新

  • dongzhuo8210 2015-01-21 23:53
    关注

    You need to quote your values when it comes to strings

    ('$fullname', '$guest_email', '$password')
    

    Important note about password storage:

    I noticed you may be storing passwords in plain text. If this is the case, it is highly discouraged and if used on a live site, you will get hacked.

    I recommend you use CRYPT_BLOWFISH or PHP 5.5's password_hash() function. For PHP < 5.5 use the password_hash() compatibility pack.

    If and when you do use one of those, make sure the column is long enough to accomodate the hash.

    Plus, in regards to SQL injection which you are presently open to, use mysqli with prepared statements, or PDO with prepared statements, they're much safer.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(2条)

报告相同问题?

悬赏问题

  • ¥15 基于卷积神经网络的声纹识别
  • ¥15 Python中的request,如何使用ssr节点,通过代理requests网页。本人在泰国,需要用大陆ip才能玩网页游戏,合法合规。
  • ¥100 为什么这个恒流源电路不能恒流?
  • ¥15 有偿求跨组件数据流路径图
  • ¥15 写一个方法checkPerson,入参实体类Person,出参布尔值
  • ¥15 我想咨询一下路面纹理三维点云数据处理的一些问题,上传的坐标文件里是怎么对无序点进行编号的,以及xy坐标在处理的时候是进行整体模型分片处理的吗
  • ¥15 CSAPPattacklab
  • ¥15 一直显示正在等待HID—ISP
  • ¥15 Python turtle 画图
  • ¥15 stm32开发clion时遇到的编译问题