我的代码将一条空记录插入MySQL表“activate”,而不是获取数据activate.html。它调用了我剥离的 activate.php 。我还应该补充一点,我是 php 新手,但知道注入(inject)攻击。我最初解决了一些安全问题,但正如我所说,我已经精简了代码以找到问题的根源。另外,当我回显表单字段时,它们会填充,但不会填充到 MySql 表中。有什么想法吗?预先感谢您。
<?php
$host = "host"; // Host name
$username = "user"; // Mysql username
$password = "pass"; // Mysql password
$db_name = "db"; // Database name
$tbl_name = "activate"; // Table name
// Connect to server and select database.
mysql_connect("$host", "$username", "$password") or die("cannot connect");
mysql_select_db("$db_name") or die("cannot select DB");
// Get values from form
if (isset($_POST['submit'])) {
$esn = mysql_real_escape_string($_POST['esn']);
$esnverify = mysql_real_escape_string($_POST['esnverify']);
$zip = mysql_real_escape_string($_POST['zip']);
$comments = mysql_real_escape_string($_POST['comments']);
}
// Insert data into mysql
$sql = "INSERT INTO $tbl_name (esn, esnverify, zip, comments) VALUES ('$esn', '$esnverify', '$zip', '$comments')";
$result = mysql_query($sql);
// if successfully insert data into database, displays message "Successful".
if ($result) {
echo "Successful";
echo "<br />";
echo $_POST['esn'];
echo "<br />";
echo $_POST['esnverify'];
echo "<br />";
echo $_POST['zip'];
echo "<br />";
echo $_POST['comments'];
echo "<br />";
echo "<a href='thankyou.html'>Back to main page</a>";
}
else {
echo "ERROR";
}
?>
<?php
// close connection
mysql_close();
?>
激活.html
<form method="post" action="activate.php">
<p><b>ESN:</b> <input type="text" id="esn" name="esn" maxlength="50"><br/>
<b>Confirm ESN:</b> <input type="text" name="esnverify" id="esnverify" maxlength="50"><br/>
<b>Zip:</b> <input type="text" name="zip" id="zip" maxlength="5"><br/>
<p>Your comments:<br />
<textarea name="comments" rows="10" cols="40" id="comments" maxlength="500"></textarea></p>
<p><input type="submit" value="Send it!"></p></form>
最佳答案
<?php
$host = "host"; // Host name
$username = "user"; // Mysql username
$password = "pass"; // Mysql password
$db_name = "db"; // Database name
$tbl_name = "activate"; // Table name
// Connect to server and select database.
mysql_connect("$host", "$username", "$password") or die("cannot connect");
mysql_select_db("$db_name") or die("cannot select DB");
// Get values from form
if (isset($_POST['submit'])) {
$esn = mysql_real_escape_string($_POST['esn']);
$esnverify = mysql_real_escape_string($_POST['esnverify']);
$zip = mysql_real_escape_string($_POST['zip']);
$comments = mysql_real_escape_string($_POST['comments']);
// Insert data into mysql
$sql = "INSERT INTO $tbl_name (esn, esnverify, zip, comments) VALUES ('$esn', '$esnverify', '$zip', '$comments')";
$result = mysql_query($sql);
// if successfully insert data into database, displays message "Successful".
if ($result) {
echo "Successful";
echo "<br />";
echo $_POST['esn'];
echo "<br />";
echo $_POST['esnverify'];
echo "<br />";
echo $_POST['zip'];
echo "<br />";
echo $_POST['comments'];
echo "<br />";
echo "<a href='thankyou.html'>Back to main page</a>";
}
else {
echo "ERROR";
}
}
?>
<?php
// close connection
mysql_close();
?>
另外,在 html 代码中更改此内容:
将 name='submit' 添加到输入字段/提交按钮。
关于php向表中插入空白数据,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/17051447/