执行INSERT查询时“错误：'字段列表'中的错误：未知列'Connor'

Question

以下是根据用户在表单中输入的内容注册用户的函数。

function register($firstname, $lastname , $email, $password, $password2){ 
     // check if the first password is allowed 
     if(!checkLogin($email, $password)){ 
     echo "checklogin failed"; 
     return false; 
    } 

     // check if two passwords are equal 
    if(strcmp($password, $password2) != 0){ 
     echo "passwords rent the same"; 
     return false; 
    } 

    // explode the email into two pieces 
    $email = explode('@' , $email); 
    echo "" . $email[0] . " and " . $email[1] . ""; 
    $insertemail = "$email[0]-" . "$email[1]"; 
    echo "" . $insertemail . ""; 

    // connect to database and insert values 
    require("db.inc.php"); 
    $query = "INSERT into users set 
     firstname = ".mysqli_real_escape_string($link, $firstname) ." , 
     lastname = ".mysqli_real_escape_string($link, $lastname) ." , 
     email = ".mysqli_real_escape_string($link, $insertemail) ." , 
     password = ".mysqli_real_escape_string($link, $password) ." "; 
    $result = mysqli_query($link, $query) 
      or die("Error: " . mysqli_error($link)); 
    // check the query worked 
    if(!result){ 
     return false; 
    } 

    return true; 

} 

我不确定这是否有帮助，但'Connor'值是我输入到表单中的值，并存储在$ firstname中。

Answer 1

您需要包围你的SQL查询与报价文本值，更何况你的INSERT语法是有点过：

$query = "INSERT INTO users (firstname, lastname, email, password) VALUES 
      ( 
       '" . mysqli_real_escape_string($link, $firstname) . "' , 
       '" . mysqli_real_escape_string($link, $lastname) . "' , 
       '" . mysqli_real_escape_string($link, $insertemail) . "' , 
       '" . mysqli_real_escape_string($link, $password) . "' 
      ) ";