为什么我无法在提交表单时更新数据库？

Question

<form name="applyform" action="applyform.php" method="post">
    <fieldset>
        <legend>Application Details</legend>
        <p>Name :<?php echo $row ["Emp_Fname"]; ?></p>
        <p>ID number :<?php echo $row['Emp_ID']; ?></p>
        <p>Email :<?php echo $row['Emp_Email']; ?></p>
        <p>Address :<?php echo $row['Emp_Address']; ?></p>
        <p>Handphone Number :<?php echo $row['ContactNo_HP']; ?></p>
        <p>Phone Number :<?php echo $row['ContactNo_Home']; ?></p>
        <p>Date of application :<?php echo $row['Leave_RequestDate']; ?></p>
        <p>Type of leave:
           <select name="leave type">
              <option selected>Annual leave</option>
              <option>Sick leave</option>
              <option>Emergency leave</option>
              <option>Maternity leave</option>
            </select>
        </p>
        <p>Leave duration:<input type="date" name="leave_start">to<input type="date" name="leave_end"></p>
        <p>Reason:<textarea rows="4" cols="50" name="reason"></textarea></p>
        <p><input type="submit" name="submitbtn" value="Submit"/>

这是我表单的代码。有什么问题吗？

<?php

if(isset($_POST['submitbtn'])) {

  if(!$con)  {
    die("cannot connect : " .mysql_error());
  }
  $sql = ("INSERT INTO leave(Leave_Start,Leave_End,Leave_Reason)    VALUES('$_POST[leave_start]','$_POST[leave_end]','$_POST[reason]')");
  mysql_query($sql,$con);

  mysql_close($con);
}
?>  

以上是我的PHP代码。当我尝试提交表单时，数据库就是不更新，有人能帮我吗？

Answer 1

你忘了在你的PHP代码的第5行加上一个mysql_connect吗？

$con = mysql_connect('mysql_host', 'mysql_user', 'mysql_password');

Answer 2

而不是

$sql = ("INSERT INTO leave(Leave_Start,Leave_End,Leave_Reason) VALUES('$_POST[leave_start]','$_POST[leave_end]','$_POST[reason]')");

试一试

$sql = ("INSERT INTO leave(Leave_Start,Leave_End,Leave_Reason) VALUES('".$_POST["leave_start"]."','".$_POST["leave_end"]."','".$_POST["reason"]."')");

注意:执行这样的查询是不安全的，因为之前没有检查过$_POST

像这样的东西应该会更好

$sql = ("INSERT INTO leave(Leave_Start,Leave_End,Leave_Reason) VALUES('".mysqli_real_escape_string($con,$_POST["leave_start"])."','".mysqli_real_escape_string($con,$_POST["leave_end"])."','".mysqli_real_escape_string($con,$_POST["reason"])."')");

Answer 3

您需要稍微了解一下PHP变量传递和SQL注入。您的最终查询必须如下所示

 $sql = ("INSERT INTO leave(Leave_Start,Leave_End,Leave_Reason) VALUES('{".mysqli_real_escape_string($_POST['leave_start'])."}','{".mysqli_real_escape_string($_POST['leave_end'])."}','{".mysqli_real_escape_string($_POST['reason'])."}')");