PHP:将表单中的值插入 MySQL [英] PHP: Inserting Values from the Form into MySQL
问题描述
我从终端在 mysql 中创建了一个 users 表，我正在尝试创建简单的任务:从表单插入值.这是我的 dbConfig 文件
I created a users table in mysql from the terminal and I am trying to create simple task: insert values from the form. This is my dbConfig file
<?php
$mysqli = new mysqli("localhost", "root", "pass", "testDB");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
?>
这是我的 Index.php .
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<meta name="description" content="$1">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="style.css">
<title>test</title>
<?php
include_once 'dbConfig.php';
?>
</head>
<body>
<?php
if(isset($_POST['save'])){
$sql = "INSERT INTO users (username, password, email)
VALUES ('".$_POST["username"]."','".$_POST["password"]."','".$_POST["email"]."')";
}
?>
<form method="post">
<label id="first"> First name:</label><br/>
<input type="text" name="username"><br/>
<label id="first">Password</label><br/>
<input type="password" name="password"><br/>
<label id="first">Email</label><br/>
<input type="text" name="email"><br/>
<button type="submit" name="save">save</button>
<button type="submit" name="get">get</button>
</form>
</body>
</html>
点击我的保存按钮后，没有任何反应，数据库仍然是空的.我尝试了 echo'ing INSERT 查询，它按照预期从表单中获取所有值.在我尝试从终端检查这是否有效后，我登录到我的 sql 尝试从用户表中返回所有数据，但我得到了空集.
After hitting my save button, nothing happens, database is still empty. I tried echo'ing the INSERT query and it takes all values from the form as it is supposed to. After I try to check if this worked from terminal, I login into my sql try to return all data from users table and I get empty set.
推荐答案
以下代码只是声明了一个包含 MySQL 查询的字符串变量:
The following code just declares a string variable that contains a MySQL query:
$sql = "INSERT INTO users (username, password, email)
VALUES ('".$_POST["username"]."','".$_POST["password"]."','".$_POST["email"]."')";
它不执行查询.为此，您需要使用一些函数，但让我先解释一下其他内容.
It does not execute the query. In order to do that you need to use some functions but let me explain something else first.
永远不要相信用户输入:您永远不应该附加用户输入(例如来自 $_GET 或 $_POST 的表单输入)直接到您的查询.有人可以以这种方式小心地操纵输入，从而可能对您的数据库造成很大的损害.这就是所谓的 SQL 注入.您可以在此处
NEVER TRUST USER INPUT: You should never append user input (such as form input from $_GET or $_POST) directly to your query. Someone can carefully manipulate the input in such a way so that it can cause great damage to your database. That's called SQL Injection. You can read more about it here
为了保护您的脚本免受此类攻击，您必须使用准备好的语句.更多关于准备好的语句这里
To protect your script from such an attack you must use Prepared Statements. More on prepared statements here
在您的代码中包含准备好的语句，如下所示:
Include prepared statements to your code like this:
$sql = "INSERT INTO users (username, password, email)
VALUES (?,?,?)";
请注意 ? 如何用作值的占位符.接下来你应该使用 mysqli_prepare 准备语句:
Notice how the ? are used as placeholders for the values. Next you should prepare the statement using mysqli_prepare:
$stmt = $mysqli->prepare($sql);
然后开始将输入变量绑定到准备好的语句:
Then start binding the input variables to the prepared statement:
$stmt->bind_param("sss", $_POST['username'], $_POST['email'], $_POST['password']);
最后执行准备好的语句.(这是实际插入发生的地方)
And finally execute the prepared statements. (This is where the actual insertion takes place)
$stmt->execute();
注意 虽然不是问题的一部分，但我强烈建议您永远不要以明文形式存储密码.相反，您应该使用 password_hash 来存储密码的哈希
NOTE Although not part of the question, I strongly advice you to never store passwords in clear text. Instead you should use password_hash to store a hash of the password
这篇关于PHP:将表单中的值插入 MySQL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
