PHP PDO 和 Mysql [关闭]

Question

<?php
// include to get database connection
include_once 'config/db.php';

try{
    $a_id = "SELECT a.id FROM aluno a, utilizador u WHERE a.utilizador_id = u.id
    AND u.nome =" . $_POST['nome'];
    $prof = 1; 

    $query = "INSERT INTO classificacao(nota, semestre, dt_classif, 
    aluno_id, utilizador_id) VALUES (nota=:nota, semestre=:semestre, dt_classif=DEFAULT ,
    aluno_id=:aluno_id, utilizador_id=:utilizador_id)";

    $stmt = $con->prepare($query);

    $stmt->bindParam(":nota", $_POST['nota']);
    $stmt->bindParam(":semestre", $_POST['semestre']);
    $stmt->bindParam(":aluno_id", $a_id);
    $stmt->bindParam(":utilizador_id", $prof);

    // execute the query
    if($stmt->execute()){
        echo "Product was created.";
    }else{
        echo "Unable to create product.";
    }
}
catch(PDOException $exception){
    echo "Error: " . $exception->getMessage();
}

?>

我正在使用 jQuery 和 PHP 创建一个 CRUD，我几乎可以确定错误在这个文件中，我无法创建数据，并且回显“产品已创建”。和“无法创建产品”。不在任何地方显示。我想知道你是否可以帮忙

Answer 1

这是一个粗略的答案，应该可以解决注入问题、非执行查询问题和不正确的insert 语法。我没有你的数据库，所以我无法确认它是否功能齐全，但它应该更接近..

<?php
// include to get database connection
include_once 'config/db.php';
try{
    $a_id = "SELECT a.id as aid FROM aluno a, utilizador u WHERE a.utilizador_id = u.id
    AND u.nome = ?";
    $stmt = $con->prepare($query);
    $stmt->execute(array($_POST['nome']));
    while ($row = $stmt->fetch_assoc()) {
        $aids[] = $row['aid'];
        $a_id = $row['aid'];
    }
    // what are you doing if there are more than one record?
    // current execution will only have the last id as $a_id
    $prof = 1; 
    $query = "INSERT INTO classificacao(nota, semestre, aluno_id, utilizador_id) 
                VALUES (?, ?, ?, ?)";
    $stmt = $con->prepare($query);
    // execute the query
    if($stmt->execute(array($_POST['nota'], $_POST['semestre'], $a_id, $prof))){
        echo "Product was created.";
    }else{
        echo "Unable to create product.";
    }
}
catch(PDOException $exception){
    echo "Error: " . $exception->getMessage();
}
?>

注意这里使用的insert 语法。在开始时，您定义列

INSERT INTO classificacao(nota, semestre, aluno_id, utilizador_id)

然后在values 之后传递值。每个值用逗号分隔。

值 (?, ?, ?, ?)

您不会在其中传递列。 ? 是进入数据库的值的占位符。

进一步阅读的链接：

How can I prevent SQL injection in PHP?
http://dev.mysql.com/doc/refman/5.6/en/insert.html
https://dev.mysql.com/doc/refman/5.0/en/update.html
http://php.net/manual/en/pdo.prepared-statements.php