PHP未写入第一个SQL字段

Question

谢谢你们，解决了这个问题，原来是在js中有一个单词拼写不正确，总是有一些简单的东西

这是我在本地服务器上向数据库写入数据的脚本，它目前只写入2个字段，而不是别名字段，我做错了什么吗？我已经三次检查了html表单和数据库字段中的名称。

<?php
  // 1. Create connection to database

  mysql_connect('localhost','root','') or die('Could not connect to mysql: <hr>'.mysql_error());

  // 2. Select database

  mysql_select_db("trialdb") or die('Could not connect to database:<hr>'.mysql_error());

  // 3. Assign variables (after connection as required by escape string)

$alias = $_POST['alias'];
$name = $_POST['name'];
$email = $_POST['email'];

  // 4. Insert data into table

  mysql_query("INSERT INTO user_data (alias, name, email) VALUES ('$alias', '$name', '$email')"); 
  Echo 'Your information has been successfully added to the database.';  
  print_r($_POST);
  mysql_close()
?>

Answer 1

首先，您应该始终检查POST变量是否正确发送：

if (
    !isset($_POST['alias']) or
    !isset($_POST['name']) or
    !isset($_POST['email'])
) // something is wrong

其次，您不希望将用户输入直接注入sql查询。您应该首先执行一些转义(或者更好的做法是用PDO或mysqli替换不推荐使用的mysql_*驱动程序，只使用prepared statements)：

$alias = mysql_real_escape_string($_POST['alias']);
$name = mysql_real_escape_string($_POST['name']);
$email = mysql_real_escape_string($_POST['email']);

第三，在打印成功消息之前，您可能需要检查查询是否正确执行：

$res = mysql_query("INSERT INTO user_data (alias, name, email) VALUES ('$alias', '$name', '$email')"); 

echo ($res) 
    ? 'Your information has been successfully added to the database.' 
    : 'Your information couldn't be added to the database';

Answer 2

你可以试试

<?php

$conn = mysql_connect('localhost','root','') or die('Could not connect to mysql: '.mysql_error());

mysql_select_db("trialdb", $conn) or die('Could not connect to database:'.mysql_error());

$alias = $_POST['alias'];
$name = $_POST['name'];
$email = $_POST['email'];

mysql_query("INSERT INTO user_data (`alias`, `name`, `email`) VALUES ('$alias', '$name', '$email')", $conn); 

echo 'Your information has been successfully added to the database.';  

print_r($_POST); 

mysql_close();

?>