php - 为什么电子邮件值在 mysql 数据库中存储为 %email ？

Question

我对制作项目还很陌生，所以请不要介意。我使用 php、html、css 创建了一个代码，将一些数据存储到 mysql 数据库中。一切都很好，但电子邮件值在数据库中存储为 %email 。有人可以帮我吗？

电子邮件字段的 html 代码:

<div class="row">
        <div class="label">Email Id</div>
        <div class="inputaddr">
            <input type="text" id="email" required="required" class="detail" name="email"/>
        </div>
        <div class="label">Category</div>
        <div class="inputmobile">
            <input type="text" id="category" required="required" class="shortdetail" name="category"/>
        </div>                  
    </div> <!-- end of 5th row -->

.php 文件:

<?php
$conn = mysql_connect("localhost", "root", "");
$db = mysql_select_db('ssitdashboard', $conn) or die(mysql_error());

if(isset($_REQUEST['submit'])){
    $fullname = $_POST['fullname'];
    $fname = $_POST['fname'];
    $mname = $_POST['mname'];
    $raddr = $_POST['raddr'];
    $laddr = $_POST['laddr'];
    $email = $_POST['email'];
    $sex = $_POST['sex'];
    $dob = $_POST['dob'];
    $bloodgroup = $_POST['bloodgroup'];
    $mobile = $_POST['mobile'];
    $rmobile = $_POST['rmobile'];
    $category = $_POST['category'];
    $usn = $_POST['usn'];
    $branch = $_POST['branch'];
    $sem = $_POST['sem'];
    $eca = $_POST['eca'];
    $year = $_POST['years'];
    $quota = $_POST['quota'];

    $que = "INSERT INTO personal_details(name, fname, mname, raddr, laddr, email, sex, dob, blood_group, mobile, rmobile, category, usn, branch, sem, eca, year, quota) VALUES ('$fullname', '$fname', '$mname', '$raddr', '$laddr', '%email', '$sex', '$dob', '$bloodgroup', '$mobile', '$rmobile', '$category', '$usn', '$branch', '$sem', '$eca', '$year', '$quota')";
    if(mysql_query($que)){
//          echo "<script>alert('You have registered successfully')</script>";
//          echo "<script>window.open('http://www.ssit.edu.in')</script>";  
        header("Location:thankyou.html");
        exit;

    }

}

?>

在数据库中，电子邮件字段被视为 varchar(30)

Answer 1

您的查询中存在拼写错误，%email 是您想要的 $email。

话虽这么说，您应该删除所有这段代码，并将其替换为不存在巨大 SQL 注入(inject)错误的代码。您必须对插入的每个$_POST值使用mysql_real_escape_string，或者您应该使用PDO。

如果您有参数化查询，则更难犯这样的错误。 PDO 中的一个示例是:

# Using named data placeholders here
$pdo->prepare(
  "INSERT INTO personal_details(name, fname, mname, raddr, laddr,
    email, sex, dob, blood_group, mobile, rmobile, category, usn,
    branch, sem, eca, year, quota)
  VALUES (:fullname, :fname, :mname, :raddr, :laddr,
    :email, :sex, :dob, :bloodgroup, :mobile, :rmobile, :category, :usn,
    :branch, :sem, :eca, :year, :quota)";

# When executing you specify the data to be used. The same prepared statement can be
# executed many times with different data.
$pdo->execute(array('fullname' => $_POST['fullname'], 'fname' => $_POST['fname'], ...));