0

我试图弄清楚为什么这不起作用我让它只添加一个表单条目然后添加电子邮件并且它破坏了它。这对 SQL 注入也安全吗？这是错误消息

ERROR: SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens

这是我的 insert.php 代码：

<?php 

try {
$conn = new PDO('mysql:host=localhost;dbname=info', 'blah', 'test');
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare('INSERT INTO people (name, email) VALUES (:name, :email)');
$stmt->bindParam(':name', $POST_['name']);
$stmt->bindParam(':email', $_POST['email']);
$stmt->execute(array(':name' => $_POST['name']));
$stmt->execute(array(':email' => $_POST['email']));
#If one or more rows were returned...

} catch(PDOException $e){
    echo'ERROR: ' . $e->getMessage();
}

?>

如果我只从表单中插入一个值，这是工作代码：

<?php 

try {
$conn = new PDO('mysql:host=localhost;dbname=encorem2_info', 'encorem2', 'Yamaha!32088!');
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare('INSERT INTO people (name) VALUES (:name)');

$stmt->execute(array(':name' => $_POST['name']));

#If one or more rows were returned...

} catch(PDOException $e){
    echo'ERROR: ' . $e->getMessage();
}

?>

这是我在单独文件中的 html 代码：

<!DOCTYPE html>

<html>
    <head>
        <title>Welcome!</title>

    </head>
    <body>

<form action="insert.php" method="post">
Name: <input type="text" name="name" id="name" />
Email: <input type="text" name="email" id="email"/>
<input type="submit" />
</form>

    </body>

</html>
4

3 回答 3

2

执行时绑定两个参数并跳过单独的bindParam()调用。

$stmt->bindParam(':name', $POST_['name']);
$stmt->bindParam(':email', $_POST['email']);
$stmt->execute(array(':name' => $_POST['name']));
$stmt->execute(array(':email' => $_POST['email']));

应该只是

$stmt->execute(array(':name' => $_POST['name'], ':email' => $_POST['email']));
于 2012-10-31T02:17:49.407 回答
0

实际上，当您已经单独绑定了参数时，没有理由传递任何东西来执行。打电话

$stmt->execute();

在您的 bindParam 调用之后。

于 2012-10-31T02:18:59.767 回答
0

您需要在bindParamOR中传递您的数据execute。更换会更简单

$stmt->bindParam(':name', $POST_['name']);
$stmt->bindParam(':email', $_POST['email']);
$stmt->execute(array(':name' => $_POST['name']));
$stmt->execute(array(':email' => $_POST['email']));

和

$stmt->execute(array(':name' => $_POST['name'],':email' => $_POST['email']));
于 2012-10-31T02:19:36.623 回答