php - PHP中的插入

Question

$m = clearData($_POST['msg']);
$sql = "INSERT INTO messages(message,message_from)
  VALUES('$m','$_SESSION['id']')";

插入时出现错误，但未找到：

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING

Answer 1

定义文本时不能使用这样的数组。用大括号括起来：

$m = clearData($_POST['msg']);
$sql = "INSERT INTO messages(message,message_from) VALUES( '$m','{$_SESSION['id']}')";

或者：

$sql = sprintf("INSERT INTO messages(message,message_from) VALUES( '%s','%d')",
  mysql_real_escape_string($_POST['msg']),
  $_SESSION['id']
);

Answer 2

尝试这个：

$m = mysqli_real_escape_string(clearData($_POST['msg'])); // escape or whatever.  
$sessionId = mysqli_real_escape_string($_SESSION['id']); // or whatever, just escape the field

$sql = "INSERT INTO messages(message,message_from) VALUES( '{$m}','{$sessionId}')";

Answer 3

您的单引号嵌套在：

'$_SESSION['id']'

将其替换为：

"INSERT INTO messages(message,message_from)VALUES('$m','".$_SESSION['id']."')"