php - 如何将html格式的信息写入MySQL数据库

Question

好吧，我正在建立一个网站，上面有一个表单，我想将用户输入表单的所有信息保存到我的 MySQL 数据库中。表单编码如下:

<form method="post" action="claim.php" name="ClaimForm" id="ClaimForm" autocomplete="on">
    <fieldset>
        <legend>Contact Details</legend>
        <div>
            <label for="firstname" accesskey="U">Your First Name</label>
            <input name="firstname" type="text" id="firstname" placeholder="Enter your name" required />
        </div>
        <div>
            <label for="lastname" accesskey="U">Your Last Name</label>
            <input name="lastname" type="text" id="lastname" placeholder="Enter your name" required />
        </div>
        <div>
            <label for="email" accesskey="E">Email</label>
            <input name="email" type="email" id="email" placeholder="Enter your Email Address" pattern="^[A-Za-z0-9](([_\.\-]?[a-zA-Z0-9]+)*)@([A-Za-z0-9]+)(([\.\-]?[a-zA-Z0-9]+)*)\.([A-Za-z]{2,})$" required />
        </div>
        <div>
            <label for="streetaddress">Street Address</label>
            <input name="streetaddress" type="text" id="streetaddress" placeholder="123 Stanley dr." required />
        </div>
        <div>
            <label for="postalcode">Postal Code</label>
            <input name="postalcode" type="text" id="postalcode" placeholder="12345, A1B 2C3, etc." required />
        </div>
        <label for="city">City</label>
        <input name="city" type="text" id="city" placeholder="Schenectady" required />
        <div>
            <label for="state">State/Province</label>
            <input name="state" type="text" id="state" placeholder="New York" required />
        </div>
        <div>
            <label for="country">Country</label>
            <input name="country" type="text" id="country" placeholder="United States" required />
        </div>
    </fieldset>
    <fieldset>
        <legend>Extra</legend>
        <div>
            <label for="controllers" accesskey="S">Number of Controllers</label>
            <select name="controllers" id="controllers" required="required">
                <option value="0">0</option>
                <option value="1">1</option>
                <option value="2">2</option>
                <option value="3">3</option>
                <option value="4">4</option>
                <option value="5">5</option>
            </select>
        </div>
        <div>
            <label for="color" accesskey="C">Color</label>
            <select name="color" id="color" required="required">
                <option value="Black">Black</option>
                <option value="White">White</option>
                <option value="Red">Red</option>
                <option value="Blue">Blue</option>
                <option value="Gold">Gold</option>
                <option value="Purple">Purple</option>
            </select>
        </div>
    </fieldset>
    <fieldset>
        <legend>Captcha Verification</legend>
        <label for="verify" accesskey="V" class="verify"><img src="captcha.php" alt="Verification code" /></label>
        <input name="verify" type="text" id="verify" size="6" required style="width: 50px;" title="This confirms you are a human user and not a spam-bot." />
    </fieldset>
    <input type="submit" class="submit" id="submit" value="Submit" />
</form>

我尝试在 Claim.php 中使用这段代码来尝试将其保存到数据库中:

<?php
$mysql_host     = "localhost";
$mysql_username = "username";
$mysql_password = "password";
$mysql_database = "database";

mysql_select_db($mysql_database, mysql_connect($mysql_host, $mysql_username, $mysql_password));
//Sending form data to sql db.
mysqli_query("INSERT INTO Information (Firstname,Lastname,Email,StreetAddress,PostalCode,City,StateProvince,Country,Controllers,Color) VALUES ('$_POST[firstname]','$_POST[lastname]','$_POST[email]','$_POST[streetaddress]','$_POST[postalcode]','$_POST[city]','$_POST[state]','$_POST[country]','$_POST[conrollers]','$_POST[color]'))");
?>

我的代码有什么问题吗？还是我的数据库结构有误？我刚开始学习如何编码，这让我很困惑。

我的数据库结构图:

Answer 1

请使用mysqli。我已经更改了您的代码以准备插入内容。

如果你不这样做，那将是一个巨大的 SQL 注入(inject)聚会。

此外，要访问 $_POST，您应该提供一个字符串索引，如 $_POST['firstname']。虽然它的工作方式类似于 $_POST[firstname]，但 PHP 会发出警告。

<?php
$mysql_host     = "localhost";
$mysql_username = "username";
$mysql_password = "password";
$mysql_database = "database";

$mysqli  = new Mysqli($mysql_host, $mysql_username, $mysql_password, $mysql_database);
$prepare = $mysqli->prepare("INSERT INTO `Information`(`Firstname`,`Lastname`,`Email`,`StreetAddress`,`PostalCode`,`City`,`StateProvince`,`Country`,`Controllers`,`Color`) VALUES (?,?,?,?,?,?,?,?,?,?)");
$prepare->bind_param("ssssssssss", $_POST['firstname'], $_POST['lastname'], $_POST['email'], $_POST['streetaddress'], $_POST['postalcode'], $_POST['city'], $_POST['state'], $_POST['country'], $_POST['controllers'], $_POST['color']);
$prepare->execute();
$mysqli->close();
?>