php - 将 $_GET 传递给 mySQL 查询

Question

所以我有这个

$name = $_GET['fullname'];
$username = $_GET['username'];
$password = $_GET['password'];
$gender = $_GET['gender'];

$query = "INSERT INTO main (name, username, password,gender) VALUES (" . $name . "," .  $username . "," . $password . ", " . $gender . ");";

mysql_query($query) or die(mysql_error());

我将 url 传递为: http://my.website.com/submit_user_info.php?fullname=myfullname&username=myusername&password=mypassword&gender=m

如果我重写 $query 以具有硬编码值，例如 VALUES (myfullname,"...etc. 它工作正常，但我的查询 $_GETs 给我错误:

Unknown column 'myfullname' in 'field list'

为什么会这样？我该如何解决？我通常不做 PHP/MySQL，所以我不太熟悉。

Answer 1

您需要在所有变量周围加上引号:

// Sanitize with mysql_real_escape_string()
$name = mysql_reaL_escape_string($_GET['fullname']);
$username = mysql_reaL_escape_string($_GET['username']);
$password = mysql_reaL_escape_string($_GET['password']);
$gender = mysql_reaL_escape_string($_GET['gender']);

// Escaped values can be interpolated in the double-quoted string.
$query = "INSERT INTO main (name, username, password,gender) VALUES ('$name','$username','$password','$gender');";

由于您使用的是双引号字符串，您可以简单地将变量包含在被单引号包围的字符串中以进行正确插值，而不是将它们与 连接起来。 并非所有人都同意在双引号字符串中插入变量的做法，但它为这种情况增加了很多可读性，并且可能更容易调试。