为什么这不发送到我的 mysql 服务器？答案

【问题标题】：Why isn't this sending to my mysql server?为什么这不发送到我的 mysql 服务器？
【发布时间】：2016-07-06 14:23:03
【问题描述】：

所以，每次我去http://localhost/api/calls.php?gamename=test&gameowner=hi&gameownerid=1&placeid=2&serverjobid=hi&serverid=jaja&serverplayers=1&sendername=bob&senderid=3&senderage=14&senderwarnings=0&calltype=non&reportinfo=hi&suspect=none

它完全没有显示任何内容，也不会将数据发送到我的 mysql 数据库。

这是我的代码。为了安全起见，我删除了我的 mysql 信息。

<?php
$servername = "";
$username = "";
$password = "";
$database = "";

// Establish MySQL Connection
$conn = new mysqli($servername, $username, $password, $database);

// Check connection
if ($conn->connect_error) {
    die("MySafeServer Database Connection Failed: " . $conn->connect_error);
}

if (array_key_exists('param',$_GET)) {
    $gamename = $_GET['param'];
    $gameowner = $_GET['param'];
    $gameownerid = $_GET['param'];
    $placeid = $_GET['param'];
    $serverjobid = $_GET['param'];
    $serverid = $_GET['param'];
    $serverplayers = $_GET['param'];
    $sendername = $_GET['param'];
    $senderid = $_GET['param'];
    $senderage = $_GET['param'];
    $senderwarnings = $_GET['param'];
    $calltype = $_GET['param'];
    $reportinfo = $_GET['param'];
    $suspect = $_GET['suspect'];
    mysql_query("INSERT INTO mss_calls3 (gamename, gameowner, gameownerid, placeid, serverjobid, serverid, serverplayers, sendername, senderid, senderage, senderwarnings, calltype, reportinfo, suspect) VALUES ($gamename, $gameowner, $gameownerid, $placeid, $serverjobid, $serverid, $serverplayers, $sendername, $senderid, $senderage, $senderwarnings, $calltype, $reportinfo, $suspect)");
};
?>

【问题讨论】：

不要和mysql和mysqli一起玩pick-a-mix.....选择一个接口（mysqli）并坚持下去
我的意思是你使用mysqli进行数据库连接，使用mysql进行查询
如果你将来要使用 mysqli，学习使用带有绑定变量的准备好的语句，以避免讨厌的人用 SQL 注入攻击破坏你的数据库
您还必须在 VALUE 中引用不是数字的每个参数，例如：VALUES ('$gamename', '$gameowner', ....
我假设您的查询字符串中不存在键 param，因此在检查条件 if (array_key_exists('param',$_GET) 时失败

标签： php mysql

【解决方案1】：

@Mark 是对的，你应该坚持只使用 mysqli 函数。

正如@andrewsi 所说，由于您没有查询数据，因此您的代码中没有任何内容可以打印插入语句是否成功，而只是在失败时，所以我添加了“成功！”回声。您仍然需要查询数据库以查看是否插入了值。

@Matt 和@Mark 关于准备陈述的观点对于清理您的输入至关重要 - 这是安全 101，您应该在谷歌上搜索一下。

但最终，我认为 @CodeGodie 解决了您最大的问题，就是让它正常工作。您使用$_GET['param'] 将所有变量分配给相同的值，除了最后的“怀疑”。从您在问题中发布的链接中，您的查询字符串中没有“参数”。我不完全确定您要做什么，但我假设您想将参数名称与变量名称匹配。我不认为它是这样工作的，但是以下未经测试的代码应该可以帮助您：

<?php

$params = array(
  "gamename",
  "gameowner",
  "gameownerid",
  "placeid",
  "serverjobid",
  "serverid",
  "serverplayers",
  "sendername",
  "senderid",
  "senderage",
  "senderwarnings",
  "calltype",
  "reportinfo",
  "suspect"
);

$cols = "";
$vals = "";
$binding_type = "";
$get_params = array();

// first pass to build the query,
// and validate inputs exist
for ($params as $param) {
  if ( isset($_GET["$param"]) ) {
    $cols .= "$param,";
    $vals .= "?,";
    $get_params []= $_GET["$param"];
    // determine the binding type as either integer or string
    if (is_numeric($_GET["$param"]))
      $binding_type .= "i";
    else
      $binding_type .= "s";
  } else die("$param is not set");
}

// trim trailing commas
$cols = rtrim($cols, ",");
$vals = rtrim($vals, ",");

$sql = "INSERT INTO mss_calls3 ($cols) VALUES ($vals);";

$servername = "";
$username = "";
$password = "";
$database = "";

// Establish MySQL Connection
$conn = new mysqli($servername, $username, $password, $database);

// Check connection
if ($conn->connect_error) {
    die("MySafeServer Database Connection Failed: " . $conn->connect_error);
}

// prepare statement
$stmt = $conn->prepare($sql) or die($conn->error);

// bind parameters
// watch this is the tricky dynamic part I got help from the following, but may need some work:
// http://stackoverflow.com/questions/627763/php-and-mysqli-bind-parameters-using-loop-and-store-in-array
// http://no2.php.net/manual/en/mysqli-stmt.bind-param.php#89171
call_user_func_array( array($stmt, 'bind_param'), array_merge(array($stmt, $binding_type), $get_params));

// execute
if( $stmt->execute() )
  echo "success!";
else
  echo $stmt->error;

$stmt->close();
$conn->close();

?>

【讨论】：