2 回答

TA貢獻1951條經(jīng)驗 獲得超3個贊
始終嘗試使用參數(shù)化語句。函數(shù)sqlsrv_query()既做語句準(zhǔn)備又做語句執(zhí)行,可用于執(zhí)行參數(shù)化查詢。在您的情況下,您需要為數(shù)組中的?每個項目放置一個占位符$params:
<?php
...
// Parameters
$score = filter_input(INPUT_POST, 'score', FILTER_VALIDATE_INT);
$max_score = filter_input(INPUT_POST, 'maxScore', FILTER_VALIDATE_INT);
$opened = filter_input(INPUT_POST, 'opened', FILTER_VALIDATE_INT);
$finished = filter_input(INPUT_POST, 'finished', FILTER_VALIDATE_INT);
$time = filter_input(INPUT_POST, 'time', FILTER_VALIDATE_INT);
$user_id = $_SESSION['ex_uid'];
// Prepare and execute statement
$params = array($score, $max_score, $opened, $finished, $time, $user_id, $content_id);
$sql = "
INSERT INTO results (score, max_score, opened, finished, time)
VALUES (?, ?, ?, ?, ?, ?, ?)
";
$stmt = sqlsrv_query($connmssql, $sql, $params);
if ($stmt === false) {
echo "Row insertion failed.\n";
die(print_r(sqlsrv_errors(), true));
} else {
echo "Row successfully inserted.\n";
}
...
?>

TA貢獻1936條經(jīng)驗 獲得超7個贊
// Get only values
// You must be sure that your data in the same order that your SET keys in the sql string
$values = array_values($data);
// Wrap with quotes
$values = array_map(function ($value) {
return '"' . $value . '"';
}, $values);
$sql = "INSERT INTO results (score, max_score, opened, finished, time) VALUES (" . implode(',', $values) . ")";
- 2 回答
- 0 關(guān)注
- 306 瀏覽
添加回答
舉報