怎么了？ “错误：插入到......'字段列表'中的未知列'jon'”答案

【问题标题】：What is wrong? "Error: INSERT INTO.... Unknown column 'jon' in 'field list'"怎么了？ “错误：插入到......'字段列表'中的未知列'jon'”
【发布时间】：2019-11-06 18:46:39
【问题描述】：

我正在尝试将表单输入到我的数据库中，但显示了两个不同的错误

"Error: INSERT INTO movie (firstname, surname, phonenumber, email, movie, session, day) values(jon, doe, johndoe@icloud.com, 123456789, halloween, afternoon, tuesday)You have an error in your SQL syntax;
 check the manual that corresponds to your MariaDB server version for the right syntax to use near '@icloud.com, 123456789, halloween, afternoon, tuesday)' at line 3"

我尝试删除“@”符号，但结果却出现了：

"Error: INSERT INTO movie (firstname, surname, phonenumber, email, 
movie, session, day) values(jon, doe, johndoeicloud.com, 123456789, 
halloween, afternoon, tuesday)Unknown column 'jon' in 'field list'"

这是我的代码

if (!empty($firstname) || !empty($surname) || !empty($email) || !empty($phonenumber) || !empty($Localmovie) || !empty($session) || !empty($day)) {
        $host = "localhost";
        $dbUsername= "root";
        $dbPassword="";
        $dbName="tickets";

        //create connection
        $conn= new mysqli($host, $dbUsername, $dbPassword, $dbName);

        if (mysqli_connect_error()) {
        die('Connect 
Error('.mysqli_connect_errno().')'.mysqli_connect_error());
    }else{


             //$sql = "INSERT INTO tutorials_inf(name)VALUES ('".$_POST["name"]."')";
            $sql= "INSERT INTO movie
                        (firstname, surname, phonenumber, email, movie, session, day) 
                   values($firstname, $surname, $email, 
$phonenumber, $Localmovie, $session, $day)";
            if (mysqli_query($conn, $sql)) {
               echo "New record created successfully";
            } else {
               echo "Error: " . $sql . "" . mysqli_error($conn);
            }
            $conn->close();

我在 macOS Mojave 上通过 xampp 使用 phpmyadmin

【问题讨论】：

看起来你需要在值周围加上引号，它们被解释为列名，而不是字符串。
您也对sql injection attack 开放。你绝对不应该在任何面向公众的服务器上使用它。

标签： php html mysql database phpmyadmin

【解决方案1】：

将单引号添加到您的字符串表示值中，并根据您的列正确重新排列值（您错过了地方phonenumber 和 email 列值序列）

$sql= "INSERT INTO movie (firstname, surname, phonenumber, email, movie, session, day) values($firstname, $surname, $email, $phonenumber, $Localmovie, $session, $day)";

到

$sql= "INSERT INTO movie (firstname, surname, phonenumber, email, movie, session, day) values('$firstname', '$surname', '$phonenumber', '$email','$Localmovie', '$session', '$day')";

日期和字符串值应该用单引号括起来。
数字值不需要用引号括起来。

【讨论】：