在 php/mysql 中简单发布到数据库 - 编辑

Question

很简单的东西，我知道，但出现错误

<?php  
session_start();  

$dbhost = "###"; // this will ususally be 'localhost', but can sometimes differ  
$dbname = "###"; // the name of the database that you are going to use for this project  
$dbuser = "###"; // the username that you created, or were given, to access your database  
$dbpass = "###"; // the password that you created, or were given, to access your database  

mysql_connect($dbhost, $dbuser, $dbpass) or die("MySQL Error: " . mysql_error());  
mysql_select_db($dbname) or die("MySQL Error: " . mysql_error());  

mysql_select_db("###", $con);

$safe_email = mysql_real_escape_string($_POST['email']);
$sql="INSERT INTO register (email) VALUES ('{$safe_email}')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con)
?>

Answer 1

在查询调用中使用 $con 之前，它未在代码中的任何位置定义。您应该：

$con = mysql_connect(...) or die(mysql_error());

除此之外，您的代码对 SQL 注入攻击很开放。你应该有：

$safe_email = mysql_real_escape_string($_POST['email']);
$sql="INSERT INTO register (email) VALUES ('{$safe_email}')";

Answer 2

假设以下情况：

1. 您对 PHP 没有太多经验
2. 向您提供的信息是正确的
3. 这是一个示例脚本，并且您知道需要替换 $dbname 的值、$dbhost、$dbuser 和 $dbpass

请尝试以下操作，如果屏幕上出现任何输出，请报告：

    <?php  
    session_start();  

    print "Connecting and inserting email: ".$_POST['email']."...";

    $dbhost = "###"; // this will ususally be 'localhost', but can sometimes differ  
    $dbname = "###"; // the name of the database that you are going to use for this project  
    $dbuser = "###"; // the username that you created, or were given, to access your database  
    $dbpass = "###"; // the password that you created, or were given, to access your database  

    $con = mysql_connect($dbhost, $dbuser, $dbpass) or die("MySQL Error: " . mysql_error());  
    mysql_select_db($dbname) or die("MySQL Error: " . mysql_error());  

    $safe_email = mysql_real_escape_string($_POST['email']);
    $sql="INSERT INTO register (email) VALUES ('{$safe_email}')";

    if (!mysql_query($sql,$con))
    {
        die('Error: ' . mysql_error());
    }
    print "success! Inserted email with row id: ".mysql_insert_id();

    mysql_close($con)
    ?>

Answer 3

这可能只是我的问题，但你应该将字符串放在一行上，或者对字符串使用串联 (.)

$sql="INSERT INTO register (email) VALUES ('$_POST[email]')";

除此之外，你应该在将信息添加到数据库之前清理信息，否则你会要求进行 sql 注入攻击。

现在讨论实际问题。您使用了一个未定义的变量 conn。我假设您引用所建立的连接，但您从未像这样将该变量设置为连接

$conn = mysql_connect($dblocal,$dbuser,$dbpass) or die(xxx);