PHP在json对象发布的mysql中插入数据

Question

I want to send some data from a jQueryMobil.listwidget via PHP to a mysql database.

I get and post my listitems like this:

function getItems()
{ 
        var listview_array = new Array();
        $( "#itemList li" ).each(function(index) {
            listview_el = new Object();
            listview_el.id = index;
            listview_el.name=$(this).text();
            listview_el.owner="owner";
            listview_array.push(listview_el);
        });
        var stringifyObject = JSON.stringify(listview_array);
        //alert(stringifyObject);
        $.ajax({
            type: "POST",
            dataType: 'json',
            url: "insert.php",
            data: { mydata: stringifyObject },
        });
        //showItems();

}

i want to add my json-object to a mysql database/table which exists. On my request my data is sent but the if(prepStmnt) never succeeds.

 <?php

    $con = new mysqli($servername, $username, $password, $dbname);
    if (!$con) {
      die('Could not connect: ' . mysqli_error($con));
    }

    echo "preps";
    if($preparedStatement = $con->prepare('INSERT INTO Einkaufsliste (item, owner) VALUES (:name, :owner)')){
        $preparedStatement->execute(json_decode($_POST["mydata"], true));
        $preparedStatement->close();
        echo "done";
    };

    $con->close();
    ?> 

Can you please tell my why no data is stored in my db?

Answer 1

MySQLi does NOT support named parameters.

if($preparedStatement = $con->[...snip...] (:name, :owner)')){
                                            ^^^^^^^^^^^^^

That's outright illegal in MySQLi, so your prepare fails, and everything else just falls of the end of the script, because you have no error checking.

$prepare = $con->prepare(...);
if (!$prepare) {
   die(mysqli_error($con));
}

A proper mysqli prepared statement would be

$stmt = $con->prepare('INSERT ... VALUES (?, ?)');

Note the ? placeholders.

Never EVER assume your query will suceed. Even if your sql actually is correct, there's a near infinite number of ways for the query to fail. Always assume failure, check for that failure, and treat success as a pleasant surprise.