PHP/MySQL error: Could not execute INSERT INTO with PDO

Question

我是 PHP/MySQL 的初学者，试图通过表单将数据插入 table，但我一直收到这个消息：

Connected successfully ERROR: Could not execute INSERT INTO foo (firstname, lastname, landline, mobile) VALUES ('', '', ', ').

我有限的理解告诉我连接成功但没有任何东西进入 table。检查 table 确认这一点。

我正在尝试将数据从 PHP 7.1 WHMCS 服务器发送到远程主机运行 MySQL 5.1.73。我正在从 WHMCS 中提取一个用户 ID，并预先填充该字段，以便将其与其余表单数据一起发送。我将该字段设置为 "hidden" 和 "text," 没有运气。

我什至 copied/pasted 将表单单独 html 并尝试运行根目录中的所有内容。运气不好。

我使用作为指导。

form.tpl:

<form method="post" action="includes/action.php">
User ID:<input type ="text" name = "userid" value={$d} readonly> //pulls userID from WHMCS
First name:<input type="text" name="firstname">
Last name:<input type="text" name="lastname">
Landline:<input type="text" name="landline">
Mobile:<input type="text" name="mobile">
<input type="submit" value="Submit"></form>

dbconnect.php:

$servername = "fqdn.com";
$username = "few";
$password = "2many";

try {
    $conn = new PDO("mysql:host=$servername;dbname=data_base", $username, $password);
    // set the PDO error mode to exception
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    echo "Connected successfully";
    }
catch(PDOException $e)
    {
    echo "Connection failed: " . $e->getMessage();
    }

action.php:

//Open MySql Connection
include "dbconnect.php";

// prepare sql and bind parameters
$stmt = $conn->prepare("INSERT INTO foo (userid, firstname, lastname, landline, mobile) VALUES (:userid, :firstname, :lastname, :landline, :mobile)");
$stmt->bindParam(':userid', $userid);
$stmt->bindParam(':firstname', $firstname);
$stmt->bindParam(':lastname', $lastname);
$stmt->bindParam(':landline', $landline);
$stmt->bindParam(':mobile', $mobile);

// insert a row
$userid = $_POST["userid"];
$firstname = $_POST["firstname"];
$lastname = $_POST["lastname"];
$landline = $_POST["landline"];
$mobile = $_POST["mobile"];
$stmt->execute();


    echo "New records created successfully";
} catch(PDOException $e)
    {
        echo "Error: " . $e->getMessage();
    }

if (!$stmt) {
    echo "\nPDO::errorInfo():\n";
    print_r($dbh->errorInfo());
}

$conn = null;

Answer 1

在 action.php 中，您在设置变量之前使用变量。

// insert a row
$userid = $_POST["userid"];
$firstname = $_POST["firstname"];
$lastname = $_POST["lastname"];
$landline = $_POST["landline"];
$mobile = $_POST["mobile"];

// prepare sql and bind parameters
$stmt = $conn->prepare("INSERT INTO foo (id, firstname, lastname, landline, mobile) VALUES (:userid, :firstname, :lastname, :landline, :mobile)");
$stmt->bindParam(':userid', $userid);
$stmt->bindParam(':firstname', $firstname);
$stmt->bindParam(':lastname', $lastname);
$stmt->bindParam(':landline', $landline);
$stmt->bindParam(':mobile', $mobile);
$stmt->execute();

Answer 2

抱歉耽搁了。这是解决方案。

action.php:

public function insertToDb($data)
    {
        try{
           $sql = "INSERT INTO table_name (column1, column2) VALUES ('" . $data['column1']."','" .  $data['column2']."')";
            $this->con->exec($sql);
           if($this->con->lastInsertId() > 0){
                return true;
            } else {
                return "Error: " . $sql . "<br>" . $conn->error;
            }
        } catch (\PDOException $e) {
            return "Insert failed: " . $e->getMessage();
        }
    }

    public function getSingleData($d,$c)
    {
        try{
           $sql = "SELECT * FROM table_name  WHERE d='".$d."' AND c='".$c."'";
           $query = $this->con->prepare($sql);
           $query->execute();
           return $query->fetchAll(\PDO::FETCH_ASSOC);
        } catch (\PDOException $e) {
            return "Error: " . $e->getMessage();
        }
    }

编辑：@halfer 感谢您指出漏洞。

public function insertToDb($data)
    {
        try{
            $insertdata = [
                'column1' => $data['column1'],
                'column2' => $data['column2'],
                'column3' => $data['column3'],
            ];
           $sql = "INSERT INTO table_name (column1, column2,column3) VALUES (:column1,:column2,:column3)";
           $stmt= $this->con->prepare($sql);
           $stmt->execute($insertdata);
           if($this->con->lastInsertId() > 0){
                return true;
            } else {
                return "Error: " . $sql . "<br>" . $conn->error;
            }
        } catch (\PDOException $e) {
            return "Insert failed: " . $e->getMessage();
        }
    }

PHP/MySQL error: Could not execute INSERT INTO with PDO

PHP/MySQL error: Could not execute INSERT INTO with PDO

php

mysql

smarty

whmcs