PHP 来自 Web 表单问题的准备语句

Question

最近才开始使用 mysql 所以我正在慢慢掌握它，但是尝试使用 PHP 准备好的网络表单语句，并且在提交网络表单时，它只是显示php 代码。有什么建议么？

谢谢

<?php

$link = mysqli_connect("localhost", "root", "", "contactform");

if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}

$sql = "INSERT INTO contactform (firstname, surname, address1, address2, 
towncity, county, postcode) VALUES (?,?,?,?,?,?,?)";

if($stmt = mysqli_prepare($link, $sql)){
mysqli_stmt_bind_param($stmt, "sssssss", $firstname, $surname, $address1, 
$address2, $towncity, $county, $postcode);

$firstname = $_REQUEST['firstname'];
$surname = $_REQUEST['surname'];
$address1 = $_REQUEST['address1'];
$address2 = $_REQUEST['address2'];
$towncity = $_REQUEST['towncity'];
$county = $_REQUEST['county'];
$postcode = $_REQUEST['postcode'];


if(mysqli_stmt_execute($stmt)){
    echo "Records inserted successfully.";
} else{
    echo "ERROR: Could not execute query: $sql. " . mysqli_error($link);
}
} else{
echo "ERROR: Could not prepare query: $sql. " . mysqli_error($link);
}

mysqli_stmt_close($stmt);

mysqli_close($link);
?>

Answer 1

使用 eval( $text ); 会将您的字符串作为 PHP 代码执行。这就是您要找的吗？

PHP eval() function

Caution The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data

PHP 来自 Web 表单问题的准备语句

PHP Prepared statements from web form issues

php

mysql

webforms

prepared-statement

statements