从GET输入变量到不工作的SQL数据库

Question

我试图将$_GET中的变量插入到MySQL数据库中。我是个菜鸟，我不知道这是怎么回事！代码运行，它输出添加到表中的用户和用户I，但当我签入phpMyAdmin时

$username = "username";
$password = "password";
$host = "host";
$database = "database";
$input_username = $_GET["username"];
$input_userId = $_GET["userId"];
mysql_connect($host,$username,$password);
mysql_select_db($database) or die("Couldn't select database: " . $database);
$sql = "INSERT INTO  users( UserId ,  Username )        VALUES('$_GET['userId']','$_GET['username']');";
echo "Username: " . $input_username . ", UserId: " . $input_userId ." added to table.";
mysql_close();

编辑:我修改了代码，以适应回答的答案，但现在我得到了这个错误：

解析错误:语法错误、意外的T_ENCAPSED_AND_WHITESPACE、期望在第10行的PAGEPATH中的T_STRING、T_VARIABLE或T_NUM_STRING

Answer 1

你没有执行查询！加：

    $db = mysql_connect($host,$username,$password);
    mysql_select_db($database) or die("Couldn't select database: " . $database);

 $userId = mysql_real_escape_string($_GET["userid"]);
 $userName = mysql_real_escape_string($_GET["username"]);

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('". $userId  ."','". $userName  ."');";

        mysql_query($sql, $db);

Answer 2

尝试一下我已经删除了;并添加了mysql_query($sql);

<?php
$username = "sd";
$password = "asd";
$host = "sad";
$database = "asd";


$input_username = $_GET["username"];
$input_userId = $_GET["userId"];

mysql_connect($host,$username,$password);

mysql_select_db($database) or die("Couldn't select database: " . $database);

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('$_GET[userid]','$_GET[username]')";
mysql_query($sql);

echo "Username: " . $input_username . ", UserId: " . $input_userId ." added to table.";
mysql_close();
?>

Answer 3

如果您想使用易受攻击的代码，您的sql必须如下所示：

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('".$_GET["userid"]."','".$_GET["username"]."');";
mysql_query($sql, $db);