使用 PHP 将 HTML 表单数据插入 MySQL 数据库

debugcn 发表于 Dev

拦截器

我只是想弄清楚将表单数据插入数据库背后的逻辑。下面的代码（load.php）工作正常。然而，我在process.php 中以某种方式收到一个语法错误，此外我不确定我的插入代码是否正确。我也怀疑这段代码是否安全，在使用数据库时我应该考虑的关键安全因素是什么？我知道我问了很多问题，但我只是想了解全貌。我将不胜感激任何建议和想法。

谢谢！

**//process.php**

<?php
require ("load.php");
$fname= $_POST['fname'];
$lname= $_POST['lname'];

$sql = "INSERT INTO registration (firstname, lastname) VALUES ('$_POST[fname]','$_POST[lname]')";
if (mysqli_query($conn, $sql)) {
      echo "New record created successfully";
} else {
      echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}
mysqli_close($conn);
?>



**//load.php**


    <?php
    $servername = "localhost";
    $database = "registration";
    $username = "root";
    $password = "";

    $conn = mysqli_connect($servername, $username, $password, $database);
    if (!$conn) {
          die("Connection failed: " . mysqli_connect_error());
    }

    echo "Connected successfully";

    ?>




**//index.php**

<?php require ("load.php"); ?>

<html>
   <head>
      <title>Registration Form</title>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   </head>
   <body>
      <h3>Registration Form</h3>
      <form name="registration" method="post" action="process.php">
      <table border="0" cellspacing="2" cellpadding="2">
         <tr><td>First Name:</td><td><input type="text" name="fname"></td></tr>
         <tr><td>Last Name:</td><td><input type="text" name="lname"></td></tr>
         <tr><td>&nbsp;</td><td><input type="submit" name="submit" value="Register"></td></tr>
      </table>
      </form>
   </body>
</html>

德鲁旺盖加尔

尝试以下 process.php 代码这会起作用

require ("load.php");

$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname)    VALUES (?, ?)");
$stmt->bind_param("ss", $firstname, $lastname);

$fname= $_POST['fname'];
$lname= $_POST['lname'];


if ($stmt->execute()) {
      echo "New record created successfully";
} 

$stmt->close();

本文收集自互联网，转载请注明来源。

如有侵权，请联系[email protected] 删除。