我正在設置我的預訂 Web 應用程序并支持 UTF-8。我已經在運行 PHP 7 和 MySQL 以及 Apache 2。過去我嘗試過做注冊表單和登錄表，當我做預訂表時似乎最終發(fā)送回顯“失敗”。我正在使用面向對象的方法做 php這是我的bookingtest.php<?php$php_variable = 'string';// connectioninclude ('config.php');ob_start(); // if button register pressedif(isset($_POST['book'])){$fname = $_POST['fname'];$email = $_POST['email'];$phone = $_POST['phone'];$country = $_POST['country'];$swimming = $_POST['swimming'];$date = $_POST['date'];$numbercus= $_POST['numbercus'];$suits= $_POST['suits'];$certificate = $_POST['certificate'];$guide= $_POST['guide'];//inserting php form to mysql$sql_book = "INSERT INTO booking (fname, email, phone, country, swim, date, num, suits, cert, guide)VALUES ('$fname', '$email', '$phone', '$country', $swimming, '$date', '$numbercus', '$suits', '$certificate', '$guide')";//resultif ($result_book = $conn->query($sql_book)){ sleep(1); echo "success";}else{ echo "Failed ! Please check your details !";}}?>
1 回答
胡說叔叔
TA貢獻1804條經驗 獲得超8個贊
使用execute代替query和使用準備好的語句來處理 SQL INJECTION。
$sql = "INSERT INTO booking (fname, email, phone, country, swim, date, num, suits, cert, guide) VALUES (?,?,?,?,?,?,?,?,?,?)";
$stmt= $pdo->prepare($sql);
$stmt->execute([$fname, $email, $phone, $country, $swimming, $date, $numbercus, $suits, $certificate, $guide]);
- 1 回答
- 0 關注
- 139 瀏覽
添加回答
舉報
0/150
提交
取消