用PHP添加新的MySQL表行不工作[英] adding new mySQL table row with PHP doesn't work

问题描述

I got a little form:

<form id="plannerform" action="save.php" method="post">
    <input id="plannername" placeholder=" " type="text" autocomplete="off" name="plannername">
    <input id="plannersubmit" type="submit" value="eintragen">
</form>

As you can see there is the action="save.php" and method="post" on the text-input there is name="plannername".

And thats my php:

$con = mysql_connect("myHost","myUser","myPW");
if (!$con)
{
  die('Could not connect: ' . mysql_error());
}

mysql_select_db("myDB", $con);

$sql="INSERT INTO anmeldungen (FR_PM)
VALUES ('$_POST[plannername]')";

if (!mysql_query($sql,$con))
{
  die('Error: ' . mysql_error());
}
echo "1 record added";

The FR_PM is one column of my table. But when I press submit, not even a new row gets created. Nothing happens. But when I call my php with "mywebsite.com/save.php" it adds a new row in my table (with no value at "FR_PM", what's pretty obvious)

What do I do wrong?

推荐答案

one of the things that you need to learn if you are a beginner, you should try by all means to stay away from using mysql_* function this is depreciated and its no longer supported in php. instead use mysqli_* with prepared statements, or use PDO prepared statements.

prepared statments make you code looks clean and its easy to debug.

this is you example with prepared statements.

<form id="plannerform" action="save.php" method="post">
    <input id="plannername" placeholder=" " type="text" autocomplete="off" name="plannername">
    <input id="plannersubmit" type="submit" value="eintragen" name="submit">
 </form>

save.php

<?php
$servername = "localhost";
$username   = "root";
$password   = "";
$dbname     = "myDB";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if (isset($_POST['submit'])) {

    if (empty($_POST['plannername'])) {

        die("Enter plannername");
    } else {
        // prepare and bind
        $stmt = $conn->prepare("INSERT INTO anmeldungen (FR_PM) VALUES (?)");
        $stmt->bind_param("s", $_POST['plannername']);

        if ($stmt->execute()) {

            echo "New records created successfully";

        } else {

            echo "Could not insert record";
        }

        $stmt->close();

    }
}
?>

The reason I used prepared statements :

• Prepared statements reduces parsing time as the preparation on the query is done only once (although the statement is executed multiple times)
• Bound parameters minimize bandwidth to the server as you need send only the parameters each time, and not the whole query
• Prepared statements are very useful against SQL injections, because parameter values, which are transmitted later using a different protocol, need not be correctly escaped. If the original statement template is not derived from external input, SQL injection cannot occur.

But when I call my php with "mywebsite.com/save.php" it adds a new row in my table (with no value at "FR_PM", what's pretty obvious)

What do I do wrong?

Well do prevent that from happening you need to check if the form was submitted before you can actual process any thing.

Note: If we want to insert any data from external sources (like user input from a form ), it is very important that the data is sanitized and validated. always treat input from a form as if its from a very dangerous hacker