将数组保存到数据库中

Question

我从将数组插入数据库时​​出错。 错误：您的SQL语法有错误;请查看与您的MySQL服务器版本相对应的手册，以便在第23行的“访问学生应该咨询学生应参考相关部门”附近使用正确的语法。

这里低于

array 
'Choose by Subject Category or Module Code' => string '' (length=0) 
' 
Back to Home page' => string '' (length=0) 
'International' => string 'visiting students should consult the' (length=36) 
'Undergraduate' => string 'students should refer to the relevant section of the UCC' (length=56) 
'Postgraduate' => string 'students should refer to the relevant section of the UCC' (length=56) 
'Credit Weighting' => string '5' (length=1) 
'Teaching Period(s)' => string 'Teaching Period 1.' (length=18) 
'No. of Students' => string 'Min 15, Max 30.' (length=15) 
'Pre-requisite(s)' => string 'None' (length=4) 
'Co-requisite(s)' => string 'None' (length=4) 
'Teaching Methods' => string '1 x 4hr(s) Lectures; Other (Distance Education Module - Up to 146hrs Self Directed Study).' (length=90) 
'Module Co-ordinator' => string 'Dr Peter Cleary, Department of Accounting, Finance and Information Systems.' (length=75) 
'Lecturer(s)' => string 'Staff, Department of Accounting, Finance and Information Systems.' (length=65) 
'Module Objective' => string 'To examine the management uses of accounting information and to enhance students ability to exert effective managerial control.' (length=127) 
'Module Content' => string 'Topics include; the accounting information needs of management, costs and pricing; estimating costs; the identification of key performance indicators; budgeting for control; capital investment appraisal and implications for strategic planning and control.' (length=256) 
'Learning Outcomes' => string 'On successful completion of this module, students should be able to:' (length=68) 
'Assessment' => string 'Total Marks 100: Continuous Assessment 100 marks (Project/ Essay. Approximately 1500 words.).' (length=93) 
'Compulsory Elements' => string 'Continuous Assessment.' (length=22) 
'Penalties (for late submission of Course/Project Work etc.)' => string 'Where work is submitted up to and including 7 days late, 10% of the total marks available shall be deducted from the mark achieved. Where work is submitted up to and including 14 days late, 20% of the total marks available shall be deducted from the mark achieved. Work submitted 15 days late or more shall be assigned a mark of zero.' (length=336) 
'Pass Standard and any Special Requirements for Passing Module' => string '40%.' (length=4) 
'End of Year Written Examination Profile' => string 'No End of Year Written Examination.' (length=35) 
'Requirements for Supplemental Examination' => string 'Marks in passed element(s) of Continuous Assessment are carried forward, Failed element(s) of Continuous Assessment must be repeated (Resubmission of revised Continuous Assessment).' (length=181) 

阵列下面是查询。

//============== INSERT QUERY================// 
$result = array();  
foreach($result as $snode){ 
$query = sprintf("INSERT INTO save_array 
     (ModuleCode, 
     Homepage, 
     International, 
     ......) VALUES ('%s')",mysql_real_escape_string($snode)); 


foreach ($result as $key => $value) 
$query = $query . "$value"; 

echo '<br /><br />'; 
mysql_query($query) or die($query."<br/><br/>".mysql_error()); 
echo $snode. '<br />'; 
} 
echo '<br /><br /><br />'; 

任何帮助，将不胜感激摸不着头脑。

//================== New Updated Query Using Mysqli ============================= 

$result = array(); 
foreach($result as $snode){ 
$snode = mysql_real_escape_string($snode); 
$query = sprintf("INSERT INTO save_array 
     (ModuleCode,Homepage,International,.......)VALUES ('%s')",implode("','",$result)); 

echo $query. '<br />'; 

foreach ($result as $key => $value) 
    $query = $query . "$value"; 
$result = mysql_query($query) or die (mysql_error()); 
} 

我重复查询，似乎是正确的值插入右列，但没有执行到数据库中。

错误：您的SQL语法错误;检查与您的MySQL服务器版本相对应的手册，以便在附近使用正确的语法。“访问学生应该咨询学生应该参考第23行的相关部分”

Answer 1

你想保存到多个列：

ModuleCode, 
Homepage, 
International, 
Undergraduate, 
... 

与单个值('%s')

还指出，mysql_real_escape_string需要单价值，而不是一个数组（我假设$ snode是一个数组）。 也可以考虑使用PDO或mysqli。

你可以这样做（只是举例，不知道该$ snode结构），并检查输出：

foreach($snode as &$val) { 
    $val = mysql_real_escape_string($val); 
} 
...VALUES ('%s'),implode("','",$snode) 

更新：

我不能找到一个问题;该查询应该工作。 我甚至在我的系统（假设VARCHAR每一列（256））和您的查询输出创建了表的结构奋力（插入）如预期..

$result = array(); 
foreach($result as $snode) { 

    foreach($snode as &$val) { 
     $val = mysql_real_escape_string($val); 
    } 

    $query = sprintf("INSERT INTO save_array (
     ModuleCode,Homepage,International,Undergraduate,Postgraduate,CreditWeighting, 
     TeachingPeriod,NoofStudents,Prerequisite,Corequisite,TeachingMethods, 
     ModuleCoordinator,Lecturer,ModuleObjective,ModuleContent,LearningOutcomes, 
     Assessment,CompulsoryElements,Penalties,PassStandard, 
     EndofYearWrittenExamination,RequirementsforExamination) 
     VALUES ('%s')",implode("','",$snode)); 

    $result = mysql_query($query) or die (mysql_error()); 
} 

运行上面的代码片段为它是;不要改变任何东西。

Answer 2

回应您的$查询，您会看到。 这不是一个有效的SQL语句。

规则编号1,2和3用于调试动态查询：查看查询本身。

Answer 3

您的主要问题是引号：

('%s') 

然后您：

mysql_real_escape_string 

它导致你的SQL冲突。使用MySQL转义或'。

所以发生的是，你的双逃避你的SQL输入，这是造成其实际的SQL注入...

而且MYSQL真正转义字符串将不插入$ snode作为数组。你将需要foreach提取数组building和array来注入SQL查询的数组。

Answer 4

假设你的阵列$node是在相同的顺序列你已经证明，你可以使用vsprintf()，而不是生成结果查询：

// assuming $node is the array with the data 
// generate list of place holders 
$placeholders = join(',', array_fill(0, count($node), "'%s'")); 

// construct full query using array_map applied to the escaping function 
$query = vsprintf("INSERT INTO save_array (ModuleCode, 
     Homepage, 
     International, 
     Undergraduate, 
     Postgraduate, 
     CreditWeighting, 
     TeachingPeriod, 
     NoofStudents, 
     Prerequisite, 
     Corequisite, 
     TeachingMethods, 
     ModuleCoordinator, 
     Lecturer, 
     ModuleObjective, 
     ModuleContent, 
     LearningOutcomes, 
     Assessment, 
     CompulsoryElements, 
     Penalties, 
     PassStandard, 
     EndofYearWrittenExamination, 
     RequirementsforExamination) VALUES ($placeholders)", 
      array_map('mysql_real_escape_string', $node) 
); 

顺便说一句，不要使用mysql_功能！