-2

解决了问题的前一部分，仍然需要了解为什么这不起作用:)

回到分别转义字符串，我有这个。

    mysql_query("INSERT INTO users (firstname,surname,email,password,birthday,birthmonth,birthyear,houseno,streetname,town,country,postcode,phonenumber,singer,songwriter,producer,composer,band,instrument,instrument2,extra,confirmcode) VALUES ('".$firstname."','".$surname."','".$email."','".$password."',".$birthday.",".$birthmonth.",".$birthyear.",'".$houseno."','".$streetname."','".$town."','".$country."','".$postcode."',".$phonenumber.",".$singer.",".$songwriter.",".$producer.",".$composer.", ".$band.",'".$instrument."','".$instrument2."','".$extra."','".$rand."')",
    mysql_real_escape_string($surname),
    mysql_real_escape_string($firstname),
    mysql_real_escape_string($stown),
    mysql_real_escape_string($houseno),
    mysql_real_escape_string($streetname),
    mysql_real_escape_string($extra),
    mysql_real_escape_string($email)) or die ('pood'); 
    echo $streetname;

我收到了 die 错误 - 所以它不回显 $streetname; （应该是'Clark\'s Way'），并且似乎没有反斜杠撇号，因为它没有被输入数据库。

抱歉，如果我没有按照您的标准进行研究，但我一直在试图理解为什么这几个小时都不起作用。

谢谢 ：）

4

2 回答 2

0

mysql_query()不接受这样的多个论点。您需要转义查询字符串中的每个变量。像这样：

... VALUES ('".mysql_real_escape_string($firstname)."','".mysql_r...

所以，你最终会得到这样的东西：

$query = "INSERT INTO users (firstname,surname,email,password,birthday,
birthmonth,birthyear,houseno,streetname,town,country,postcode,
phonenumber,singer,songwriter,producer,composer,band,instrument,
instrument2,extra,confirmcode) VALUES (
'". mysql_real_escape_string($firstname) ."',
'". mysql_real_escape_string($surname) ."',
'". mysql_real_escape_string($email) ."',
'". mysql_real_escape_string($password) ."',
'". mysql_real_escape_string($birthday) ."',
'". mysql_real_escape_string($birthmonth) ."',
'". mysql_real_escape_string($birthyear) ."',
'". mysql_real_escape_string($houseno) ."',
'". mysql_real_escape_string($streetname) ."',
'". mysql_real_escape_string($town) ."',
'". mysql_real_escape_string($country) ."',
'". mysql_real_escape_string($postcode) ."',
'". mysql_real_escape_string($phonenumber) ."',
'". mysql_real_escape_string($singer) ."',
'". mysql_real_escape_string($songwriter) ."',
'". mysql_real_escape_string($producer) ."',
'". mysql_real_escape_string($composer) ."',
'". mysql_real_escape_string($band) ."',
'". mysql_real_escape_string($instrument) ."',
'". mysql_real_escape_string($instrument2) ."',
'". mysql_real_escape_string($extra) ."',
'". mysql_real_escape_string($rand) ."')";

mysql_query($query) or die (mysql_error());

对不起，如果那里有错字。但我想你明白了。

这是参数化查询如何工作的（未经测试的）示例，改编自手册中的示例：

$query = "INSERT INTO users (firstname,surname,email,password,birthday,
birthmonth,birthyear,houseno,streetname,town,country,postcode,
phonenumber,singer,songwriter,producer,composer,band,instrument,
instrument2,extra,confirmcode) VALUES (
:firstname, :surname, :email, :password, :birthday, :birthmonth,
:birthyear, :houseno, :streetname, :town, :country, :postcode, :phonenumber,
:singer, :songwriter, :producer, :composer, :band, :instrument, :instrument2,
:extra, :rand)";

// assume $dbh is your PDO database connection
$sth = $dbh->prepare($query);
$sth->bindParam(':firstname', $firstname);
$sth->bindParam(':surname', $surname);
$sth->bindParam(':email', $email);
$sth->bindParam(':password', $password);
$sth->bindParam(':birthday', $birthday);
// and so on...

$sth->execute();
于 2012-12-08T03:09:33.753 回答
0

该错误是由于反斜杠引号引起的。删除反斜杠，它看起来应该可以工作。

之前： VALUES (\'Joshua\',\'Oakley\',
之后： VALUES ('Joshua','Oakley',

于 2012-12-08T02:22:31.177 回答