duanmu6752 2015-10-03 15:57 采纳率: 0%
浏览 63
已采纳

参数值导致错误[重复]

This question already has an answer here:

I've created a function to insert data different from displaying data. Then I get an error. Unknown column '$prod_name' in 'field list'. Please tell me any right suggestions because im a beginner in pdo. thanks

here is my code:

<?php
    function run_db($sqlcom){
        $con = new PDO('mysql:host=localhost; dbname=product', 'root', '');
        $con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $stmt = $con->prepare($sqlcom);
        $stmt->execute();
        return $stmt;
    }

    function insertData($sqlcom)
    {
        $con = new PDO('mysql:host=localhost; dbname=product', 'root', '');
        $con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $stmt = $con->prepare($sqlcom);
        $stmt->execute();
        return $stmt;
    }



    if(isset($_POST['btn-insert'])){

        $prodname = $_POST['prod_name'];
        $prodsupp = $_POST['prod_supplier'];
        $prodprice = $_POST['prod_price'];

        try{
            $stmt = insertData('INSERT INTO tbl_product(prod_name, prod_supplier, prod_price)VALUES($prodname, $prodsupp, $prodprice)');
        }catch(Exception $e){
            die('error : ' . $e->getMessage());
        }
    }
?>
<html>
    <head><title></title></head>
    <body>
            <table cellpadding="4" cellspacing="2" border='1'>
                <tr>
                    <th>Product ID</th>
                    <th>Product NAME</th>
                    <th>Product SUPPLIER</th>
                    <th>Product PRICE</th>
                </tr>
                <?php $stmt = run_db('SELECT * FROM tbl_product'); while($product = $stmt->fetch(PDO::FETCH_OBJ)) { ?>
                <tr>
                    <td><?php echo $product->prod_id; ?></td>
                    <td><?php echo $product->prod_name; ?></td>
                    <td><?php echo $product->prod_supplier; ?></td>
                    <td><?php echo $product->prod_price; ?></td>
                </tr>
                <?php } ?>
            </table>
            <br>
            <br>

            <form action="" method="post">
                <table cellspacing="2" cellpadding="2" border="1">
                    <tr>
                        <td>Product name:</td>
                        <td><input type="text" name="prod_name"></td>
                    </tr>
                    <tr>
                        <td>Product supplier:</td>
                        <td><input type="text" name="prod_supplier"></td>
                    </tr>
                    <tr>
                        <td>Product Price:</td>
                        <td><input type="text" name="prod_price"></td>
                    </tr>
                    <tr>
                        <td colspan="2"><input type="submit" name="btn-insert" value="INSERT"></td>
                    </tr>
                </table>
            </form>

    </body>
</html>
</div>

展开全部

  • 写回答

1条回答 默认 最新

  • doumo2501 2015-10-03 16:01
    关注

    String literals in SQL are denoted by single quotes ('s). Without them, a bareword is interpreted as an object (column, in this case) name, and the query fails when such an object doesn't exist.

    To solve this issue, you could surround your inserted values with quotes:

    $stmt = insertData("INSERT INTO tbl_product(prod_name, prod_supplier, prod_price)VALUES('$prodname', '$prodsupp', '$prodprice')");
    

    Mandatory comment:
    Using string replacement in SQL is a bad practice that leaves your code vulnerable to SQL injection attacks. You should consider using prepared statements instead.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
编辑
预览

报告相同问题?

手机看
程序员都在用的中文IT技术交流社区

程序员都在用的中文IT技术交流社区

专业的中文 IT 技术社区,与千万技术人共成长

专业的中文 IT 技术社区,与千万技术人共成长

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

客服 返回
顶部