在我的脚本SQL中，数据库中的行为空

Question

我正试图找出这些表单脚本中的问题。

我想在SQL server中创建一行，其中包含将插入HTML表单的数据，但每次只创建空行，而不插入表单输入。

HTML

<form action="insert2.php" method="post">
<label for="First_name">First_name:</label>
<input type="text" name="First_name" id="First_name">
<label for="PASSWORD">PASSWORD:</label>
<input type="text" name=value name="pass" id="pass">
<label for="Emailaddress">Emailaddress:</label>
<input type="text" name=value name="email" id="email">
<input name="submit" type="submit" value="Submit">
</form>

PHP

<?php
if(isset($_POST['submit'])){
$First_name   = $_REQUEST['First_name'];
$pass         = $_REQUEST['password'];
$email        = $_REQUEST['Emailaddress'];
}

$servername = "host";
$username = "user";
$password = "";
$dbname = "dbname";
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO users(First_name, PASSWORD, Emailaddress)
VALUES ('$First_name', '$pass', '$email')";
$conn->exec($sql);
echo "New record created successfully";
}
catch(PDOException $e)
{
echo $sql . "<br>" . $e->getMessage();
}
$conn = null;
?>

Answer 1

发布的值应设置为$_POST['ExampleField']，而不仅仅是具有该名称的变量。

例如：$First_name应为$_POST['First_name']

如果你查看错误日志，你可能会发现代码中有未定义的变量错误，因为$First_name、$PASSWORD和$Emailaddress从未定义过。

此外，您应该避免直接将变量放入这样的查询中，这会使您面临巨大的安全风险。我建议阅读SQL注入(https://www.w3schools.com/sql/sql_injection.asp)和绑定参数(https://www.php.net/manual/en/pdostatement.bindparam.php)看看如何避免这些风险。

Answer 2

您需要在某种提交后检索值。您有一个提交按钮，但您需要给它一个名称(我将其命名为submit(。此代码应该可以工作，但您很容易受到注入攻击。

PHP

<?php
if(isset($_POST['submit'])){
$First_name   = $_REQUEST['First_name'];
$pass         = $_REQUEST['PASSWORD'];
$email        = $_REQUEST['Emailaddress'];
}
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO users(First_name, PASSWORD, Emailaddress)
VALUES('$First_name','$pass','$email')";
$conn->exec($sql);
echo "New record created successfully";
}
catch(PDOException $e)
{
echo $sql . "<br>" . $e->getMessage();
}
$conn = null;
?>

HTML

<form action="insert2.php" method="post">
<label for="First_name">First_name:</label>
<input type="text" name="First_name" id="First_name">
<label for="PASSWORD">PASSWORD:</label>
<input type="text" name="PASSWORD" id="PASSWORD">
<label for="Emailaddress">Emailaddress:</label>
<input type="text" name="Emailaddress" id="Emailaddress">
<input name="submit" type="submit" value="Submit">
</form>