获取url参数并插入数据库 [英] Get url parameter and insert into database

问题描述

尝试通过在 url 中键入值来插入数据库，但插入数据库时​​遇到困难:

Trying to insert into database by typing the value in the url, but having difficulties to insert into the database:

网址如下:

http://student.cs.hioa.no/~s180343/updatedb.php?verdi=22

代码如下:

<?php

$dbhost = "MYSQL-SERVER";
$dbuser = "USERNAME";
$dbpass = "";
$verdi = $_GET['verdi'];

$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
  die('Could not connect: ' . mysql_error());
}
$sql = "INSERT INTO test ('id') VALUES (`$verdi`)";

mysql_select_db('s180350');
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
  die('Could not enter data: ' . mysql_error());
}
echo "Entered data successfully\n";
mysql_close($conn);
?>

推荐答案

在字符串值周围使用引号.在列名称周围使用刻度线.你把它倒过来了:

Use quotes around your string values. Use ticks around your column names. You have it backwards:

$sql = "INSERT INTO test ('id') VALUES (`$verdi`)";

应该是

$sql = "INSERT INTO test (`id`) VALUES ('$verdi')";

仅供参考，您对SQL注入

这篇关于获取url参数并插入数据库的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！