php - SQL错误插入到表中

Question

我一直在我的 php.ini 中收到这个错误。当我硬设置值但似乎不适用于变量时，它工作正常。

Error: INSERT INTO ContactUS (name, email, subscribed) VALUES (TEST, my@email.com, 1) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Anis, my@email.com, 1)' at line 1

// Create connection
            $conn = new mysqli($servername, $username, $password, $dbname);
            // Check connection
            if ($conn->connect_error) {
                die("Connection failed: " . $conn->connect_error);
            } 

            $sql = "INSERT INTO ContactUS (name, email, subscribed) VALUES ($name, $email, $subscribed)";

            if ($conn->query($sql) === TRUE) {
                echo "New record created successfully";
            } else {
                echo "Error: " . $sql . "<br>" . $conn->error;
            }

Answer 1

应该引用值:

$sql = "INSERT INTO ContactUS (name, email, subscribed) VALUES ('$name', '$email', '$subscribed')";

也许最好使用准备好的语句，因为这是自动为您完成的并且您不会容易受到SQL injections 的攻击。 .