php – 我无法将表单数据导入数据库.我究竟做错了什么？

<?php 
    //connect to database
    $mysql_host = 'localhost';
    $mysql_user = 'root';
    $mysql_pass = '';

    $mysql_db = 'test';

    if (!mysql_connect ($mysql_host,$mysql_user,$mysql_pass)||!mysql_select_db ($mysql_db) ) {
        die(mysql_error());

    }   

    // Code     
    if (isset($_POST['firstname'])&&
    isset($_POST['surname'])) {

    $firstname = $_POST['firstname'];
    $surname = $_POST['surname'];

    if (!empty($username)&&!empty($password)) {
    $query = "INSERT INTO `test`.`test_tabell` 
    VALUES ('','" . mysql_real_escape_string($firstname) . "','" . mysql_real_escape_string($surname) . "')";
    /*$query = "INSERT INTO `test`.`test_tabell` VALUES (``,`.$firstname.`,`.$surname.`)"; */
    $query_run = mysql_query($query);
if (!$query_run) echo mysql_error(); 
}
}
    ?>

    <form action="add.php" method="POST">
    Firstname:<br> <input type="text" name="firstname" value="<?php if (isset($firstname)) { echo $firstname; } ?>"><br><br>
    Surname:<br> <input type="text" name="surname" value="<?php if (isset($surname)) { echo $surname; } ?>"><br><br>
    <input type="submit" value="Submit">
    </form>

不要使用mysql特定的语法,它已经过时了,当你需要做一些高级的东西时它开始很烦人,你不能切换到sqlite或postgresql.

我建议使用PDO,你可以这样做：

// Usage:   $db = connectToDataBase($dbHost,$dbName,$dbUsername,$dbPassword);
// Pre:     $dbHost is the database hostname,//          $dbName is the name of the database itself,//          $dbUsername is the username to access the database,//          $dbPassword is the password for the user of the database.
// Post:    $db is an PDO connection to the database,based on the input parameters.
function connectToDataBase($dbHost,$dbPassword)
{
    try
    {
         return new PDO("mysql:host=$dbHost;dbname=$dbName;charset=UTF-8",$dbPassword);
    }
    catch(PDOException $PDOexception)
    {
        exit("<p>An error ocurred: Can't connect to database. </p><p>More preciesly: ". $PDOexception->getMessage(). "</p>");
    }
}

然后初始化变量(我想你忘了定义数据库的名称);

$host = 'localhost';
$user = 'root';
$dataBaseName = 'databaseName';
$pass = '';

现在您可以通过访问您的数据库

$GLOBALS['db'] = connectToDataBase($host,$databaseName,$user,$pass);

现在您有一个PDO数据库donnection的实例.

我想要指出的一件事是,你对sql注入是有用的,你想在查询中使用预准备语句,如：

$query = "INSERT INTO test(first_name,sur_name) VALUES (:firstname,:surname);";

我们将在查询中执行两个变量$firstName和$surName,使它们替换：firstName和：surName的值,让我先创建一个简单的插入函数给你看：

function insertFunction($db,$query,$firstName,$surName)
{
    $statement = $db->prepare($query);
    return $statement->execute(array(":firstName" => $firstName,":surName" => $surName));
}

所以你很容易做类似的事情

$firstName = 'Smith';
$surName = 'John';
$db = $GLOBALS['db'];

$success = insertFunction($db,$surName);

现在,您可以通过检查$success是true还是false来检查它是否成功.

如果你想看到更高级的PDO使用(多行等),那么你可以在这里查看我的一条评论：Javascript function as php?
(不是最高评论).

我希望这有帮助.如果有什么奇怪的话请评论.