php - SQL : username and password not recognized correctly

Question

..其中我无法弄清楚确切的问题是什么和/或解释者为什么提示这个。我会发布我的代码:

<?php

    $path = realpath(dirname(__FILE__));

    require("../data/userhandler.class.php");

    $db = connectViaPdo();
    //var_dump($db);

    $userHandler = new UserHandler($db);

    $username = $_POST['username'];
    $password = $_POST['password'];
    $email = $_POST['email'];
    $ip = $_SERVER['REMOTE_ADDR'];

    $query = "select username, password from users where ip = {$ip}";
    $stmt = $db->prepare($query);
    $result = $stmt->fetch();

    if(!$result)
    {
        $isBanned = $userHandler->checkIfBanned($ip);

        if (!$isBanned)
        {
            $query = "INSERT INTO users(username, password, ip, email) VALUES({$username}, {$password}, {$ip}, {$email})";
            $stmt = $db->prepare($query);
            $result = $stmt->execute();
        }
        else
        {
            echo "You are BANNED from this server. Leave now and do not come back.";
            exit();
        }   
    }
    else
    {
        $query = "UPDATE users SET username = {$username}, password = {$password}, email = {$email} WHERE ip = {$ip} ";
        $stmt = $db->prepare($query);
        $result = $stmt->execute();
    }


?>

我的输出类似于以下内容:

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.193.239, test@email.com)' at line 1' in /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php:29 Stack trace: #0 /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php(29): PDOStatement->execute() #1 {main} thrown in /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php on line 29

虽然我确实遵循了 Stacktrace，但它似乎真的没有任何帮助:我的 PDOstatement 是正确的。

Answer 1

我认为您的字符串值需要在引号内:

$query = "INSERT INTO users(username, password, ip, email) VALUES('{$username}', '{$password}', '{$ip}', '{$email}')";