无法插入表格。 PHP/MySQL

Question

我在数据库'db2'中有一个名为'Directors'的表。 我有一个HTML表单。我想在插入值并点击提交按钮时，将内容插入新行（插入到INSERT INTO）中的表中，然后进行一些验证（您会在脚本中注意到它们）。我试图自己做，但总是回应我'失败'; 这是我的HTML表单：

<form action="process.php" method="post" accept-charset="utf-8"> 
<input type="hidden" name="pages_edit_nonce" />   

      <div class="section-item page-title-section"> 
       <label for="title">Full Name:</label><span class="help">*</span><div class="input-wrap"><input type="text" name="name" value="" /></div>  </div> 



    <div class="section-item"> 
     <label for="label">Phone:</label><span class="help">*Optionally</span><div class="input-wrap"><input type="text" name="phone" value="" /></div>  </div> 

    <div class="section-item"> 
     <label for="redirect">Е-mail:</label><span class="help">*</span><div class="input-wrap"><input type="text" name="email" value="" placeholder="" /></div>  </div> 

    <div class="section-item"> 
     <label for="redirect">School:</label><span class="help">*</span><div class="input-wrap"><input type="text" name="school" value="" placeholder="" /></div>  </div> 

    <div class="section-item"> 
     <label for="redirect">City:</label><span class="help">*</span><div class="input-wrap"><input type="text" name="city" value="" placeholder="" /></div>  </div> 

    <div class="section-item"> 
     <label for="redirect">Password:</label><span class="help">*</span><div class="input-wrap"><input type="password" name="password" value="" placeholder="" /></div>  </div> 

    <div class="admin-bar"> 
     <div class="admin-bar-inner"> 


      <input type="submit" value="Submit" class="btn" /> 
     </div> 
    </div> 

    </form> 

这是我process.php文件：

$server = "localhost"; 
    $user = "****"; 
    $pass = "****"; 

    $conn = mysql_connect($server, $user, $pass); 
    $db = mysql_select_db("****", $conn); 
    session_start(); 
    if(!$db) { 
     $_SESSION['ERRMSG'] = "<strong>Error:</strong> The access to the database is denied!"; 
     header("Location: ../../admin/error/"); 
     exit(); 
    } 

    session_start(); 

    function UniqueID() { 
     $UID = rand(); //Create unique ID 
     $check = mysql_query("SELECT * FROM `Directors` WHERE `UID` = '$UID'"); 
     if(mysql_num_rows($check) > 0) { //Check if it exists 
      UniqueID(); //Redo the function 
     } else { 
      return $UID; //return the uniqueid 
     } 
    } 

    $UID = UniqueID(); //Unique ID 
    $email = $_POST['email']; 
    $password = $_POST['password']; 
    $name = $_POST['name']; 
    $phone = $_POST['phone']; 
    $school = $_POST['school']; 
    $city = $_POST['city']; 

    //Create INSERT query 
    $qry = "INSERT INTO `oclass`.`Directors`(`UID`,`Name`, `Phone`, `Email`, `SchoolGymnasium`, `City`, `Password`) VALUES('$UID','$name','$phone','$email','$school','$city','" . md5($password) . "')"; 
    $result = mysql_query($qry); 

    //Check whether the query was successful or not 
    if($result) { 
     $_SESSION['SUCCMSGADDDIR'] = 'Sucessful.'; 
     header("location: URL"); 
     exit(); 
    } else { 
     $_SESSION['ERRMSGADDDIR'] = 'Fail'; 
     header("location: URL"); 
    } 

改变与mysql_error错误会话（后），它给了我下面的错误： 致命错误：在第10行的写上下文中不使用函数返回值; 线路10：

mysql_error() = "<strong>Error:</strong> The access to the database is denied!"; 

我已经删除了名为ID列（这是主键），并设置UID列作为主键，并且现在正在工作。感谢你们。

Answer 1

首先，您一定从未听说过SQL注入http://en.wikipedia.org/wiki/SQL_injection。您当前的代码正在向您提供攻击。您不能像用户那样直接将用户输入插入到数据库中。另外mysql_ *函数也被弃用。为了帮助您的代码更加安全，更新的尝试是这样的：

session_start(); 

$host = "localhost"; 
$user = "****"; 
$pass = "****"; 
$db = "****"; 

$dbh = new PDO("mysql:host=$host;dbname=$db", $user, $pass); 
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

$stmt = $dbh->prepare("INSERT INTO `oclass`.`Directors`(`UID`,`Name`, `Phone`, `Email`, `SchoolGymnasium`, `City`, `Password`) VALUES (:uid, :name, :phone, :email, :school, :city, :password)"); 

$stmt->bindParam(':uid',  uniqid()); 
$stmt->bindParam(':name',  $_POST['name']); 
$stmt->bindParam(':phone', $_POST['phone']); 
$stmt->bindParam(':email', $_POST['email']); 
$stmt->bindParam(':school', $_POST['school']); 
$stmt->bindParam(':city',  $_POST['city']); 
$stmt->bindParam(':password', md5($_POST['password'])); 

$stmt->execute();