PHP无法插入数据

Question

当我使用以下代码时，我无法插入数据。它显示以下错误消息:

[An error occured while inserting your data. Please try again later.You have an error in your SQL syntax: check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 10]

if($_SERVER['REQUEST_METHOD'] != 'POST')
{   
    $sql = "SELECT
                cat_id,
                cat_name,
                cat_description
            FROM
                categories";

    $result = mysql_query($sql);

    if(!$result)
    {
        echo 'Error while selecting from database. Please try again later.';
    }
    else
    {
        if(mysql_num_rows($result) == 0)
        {
            //there are no categories, so a topic can't be posted
            if($_SESSION['userlevel'] == 1)
            {
                echo 'You have not created categories yet.';
            }
            else
            {
                echo 'Before you can post a topic, you must wait for an admin to create some categories.';
            }
        }
        else
        {

            echo '<form method="post" action="">
                Subject: <input type="text" name="topic_subject" />
                Category:'; 

            echo '<select name="topic_cat">';
                while($row = mysql_fetch_assoc($result))
                {
                    echo '<option value="' . $row['cat_id'] . '">' . $row['cat_name'] . '</option>';
                }
            echo '</select>'; 

            echo 'Message: <textarea name="post_content" /></textarea>
                <input type="submit" value="Create topic" />
             </form>';
        }
    }
}
else
{
    //start the transaction
    $query  = "BEGIN WORK;";
    $result = mysql_query($query);

    if(!$result)
    {
        //Damn! the query failed, quit
        echo 'An error occured while creating your topic. Please try again later.';
    }
    else
    {

        //the form has been posted, so save it
        //insert the topic into the topics table first, then we'll save the post into the posts table
        $sql = "INSERT INTO 
                    topics(topic_subject,
                           topic_date,
                           topic_cat,
                           topic_by)
               VALUES('" . mysql_real_escape_string($_POST['topic_subject']) . "',
                           NOW(),
                           " . mysql_real_escape_string($_POST['topic_cat']) . ",
                           " . $_SESSION['userid'] . "
                           )";

        $result = mysql_query($sql);
        if(!$result)
        {
            //something went wrong, display the error
            echo 'An error occured while inserting your data. Please try again later.' . mysql_error();
            $sql = "ROLLBACK;";
            $result = mysql_query($sql);
        }
        else
        {
            //the first query worked, now start the second, posts query
            //retrieve the id of the freshly created topic for usage in the posts query
            $topicid = mysql_insert_id();

            $sql = "INSERT INTO
                        posts(post_content,
                              post_date,
                              post_topic,
                              post_by)
                    VALUES
                        ('" . mysql_real_escape_string($_POST['post_content']) . "',
                              NOW(),
                              " . $topicid . ",
                              " . $_SESSION['userid'] . "
                        )";
            $result = mysql_query($sql);

            if(!$result)
            {
                //something went wrong, display the error
                echo 'An error occured while inserting your post. Please try again later.' . mysql_error();
                $sql = "ROLLBACK;";
                $result = mysql_query($sql);
            }
            else
            {
                $sql = "COMMIT;";
                $result = mysql_query($sql);

                //after a lot of work, the query succeeded!
                echo 'You have successfully created <a href="topic.php?id='. $topicid . '">your new topic</a>.';
            }
        }
    }
}

`

Answer 1

您错过了在每个字符串周围添加引号:

$sql = "INSERT INTO 
                    topics(topic_subject,
                           topic_date,
                           topic_cat,
                           topic_by)
               VALUES('" . mysql_real_escape_string($_POST['topic_subject']) . "',
                           NOW(),
                           '" . mysql_real_escape_string($_POST['topic_cat']) . "',
                           '" . $_SESSION['userid'] . "'
                           )";

您必须在第二个 mysql_real_escape_string 周围添加单引号。 (如果它包含一个字符串，也会围绕你的 $_SESSION['userid']。)