-2

我的代码是。

$newModel = "INSERT INTO models (id," . 
    " firstname," .
    " lastname," .
    " email," .
    " password," .
    " group," .
    " phone," .
    " timeofday," .
    " dayofweek," .
    " address," .
    " city," .
    " state," .
    " zip," .
    " gender," .
    " hair," .
    " eye," .
    " birthday," .
    " birthmonth," .
    " birthyear," .
    " bustshirt," .
    " cup," .
    " waist," .
    " hips," .
    " waist," .
    " hips," .
    " weight," .
    " inches," .
    " dressjacket," .
    " workxp," .
    " twitter," .
    " facebook," .
    " joindate," .
    " instagram," .
    " imdb," .
    " parentid," .
    " error) VALUES (".
    PrepSQL($modelid) . ", " .
    PrepSQL($firstname) . ", " .
    PrepSQL($lastname) . ", " .
    PrepSQL($email) . ", " .
    PrepSQL($password) . ", " .
    PrepSQL($group) . ", " .
    PrepSQL($phone) . ", " .
    PrepSQL($timeofday) . ", " .
    PrepSQL($dayofweek) . ", " .
    PrepSQL($address) . ", " .
    PrepSQL($city) . ", " .
    PrepSQL($state) . ", " .
    PrepSQL($zip) . ", " .
    PrepSQL($gender) . ", " .
    PrepSQL($hair) . ", " .
    PrepSQL($eyes) . ", " .
    PrepSQL($bday) . ", " .
    PrepSQL($bmonth) . ", " .
    PrepSQL($byear) . ", " .
    PrepSQL($bust) . ", " .
    PrepSQL($cup) . ", " .
    PrepSQL($waist) . ", " .
    PrepSQL($hips) . ", " .
    PrepSQL($weight) . ", " .
    PrepSQL($height) . ", " .
    PrepSQL($dressjacket) . ", " .
    PrepSQL($workxp) . ", " .
    PrepSQL($twitter) . ", " .
    PrepSQL($facebook) . ", " .
    PrepSQL($joindate) . ", " .
    PrepSQL($instagram) . ", " .
    PrepSQL($imdb) . ", " .
    PrepSQL($parentid) . ", " .
    PrepSQL($error) . ")";

mysql_query($newModel) or die(mysql_error());

它射出一个错误：

您的 SQL 语法有错误；检查与您的 MySQL 服务器版本相对应的手册，以在第 1 行的“组、电话、时间、工作日、地址、城市、州、邮编、性别、头发、眼睛”附近使用正确的语法

4

2 回答 2

7

group是MySQL 中的保留字。您必须将其包装在反引号中：

`group`,
phone

等等

于 2013-04-18T05:16:02.063 回答
4

GROUP是保留关键字，恰好是您的列的名称。为避免语法错误，您需要使用反引号对其进行转义。例如，

`group`

如果您有修改表的权限，请将非保留关键字的列名更改为避免再次出现问题。

作为旁注，SQL Injection如果变量的值（s）来自外部，则查询很容易受到攻击。请看下面的文章，了解如何预防。通过使用PreparedStatements，您可以摆脱在值周围使用单引号。

于 2013-04-18T05:16:07.350 回答