mysql插入表不起作用

Question

我正在尝试在下面进行以下插入。当我只取字符串MZ�\0\0\0\0\0\0\0��\0\0�\0\0\0，直接放入insert语句中，就可以了。但是，当我通过我的函数获取它然后尝试插入时，当从该表中选择所有内容时，我得到一个空集。

   if($_FILES)//check if cookies set
{
    require_once 'DBLogin.php';
    $conn = new mysqli($hn, $un, $pw, $db);
    if($conn -> connect_error) die($conn->connect_error);
    $username = $_REQUEST['uname'];
    //echo "admin: ".$_SESSION['admin']."<br>";


        if (!preg_match("/^[a-zA-Z0-9]+$/", $_POST['mname']))
        {
            echo "Invalid malware name. Only Numbers and Letters allowed". "<br>";
            exit();
        }
        else if(!isset($_SESSION['check']) || !isset($_COOKIE['token']) ||$_SESSION['check'] !== hash('ripemd128', $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . $_COOKIE['token']))
        {
            echo "Need to login as Admin before can upload files.<br>";
            exit();
        }
        else
        {
            verifyAdmin($conn);
            $fileGood = checkFile($_FILES);
            $entry = getSection($fileGood);

            $entry = chooseSanitization($conn,$entry, $_FILES['file']['type']);
            //$entry = mysql_entities_fix_string($conn,$entry);



            if(checkExistence($conn, $_POST['mname'],$entry) === true)
            {
                echo "Malware sequence and/or name already in database. Please upload different name/sequence. <br>";
                exit();
            }

            $title = $_POST['mname'];


            $insertQuery = "Insert into malwarelist (malwareName, sequence) values ('$title','$entry')";

            //$insertQuery = "Insert into malwarelist (malwareName, sequence) values ('$title','MZ�\0\0\0\0\0\0\0��\0\0�\0\0\0')";
            $conn -> query($insertQuery);

            echo "Malware has been added! <br>";
        }
    $conn->close();
}

function chooseSanitization($connection,$string, $fileType)
{
    if ($fileType === 'text/plain')
    {
        return mysql_entities_fix_string($connection,$string);
    }
    else
    {
        return mysql_fix_string($connection,$string);
    }
}

function mysql_entities_fix_string($connection, $string)
{
    return htmlentities(mysql_fix_string($connection, $string));
}
function mysql_fix_string($connection, $string)
{
    if (get_magic_quotes_gpc()) $string = stripslashes($string);
    return $connection->real_escape_string($string);
}

如果我尝试执行“插入恶意软件列表（恶意软件名称，序列）值（'$title','MZ�\0\0\0\0\0\0\0��\0\0�\0 \0\0')" 它有效，但如果我尝试这样做：插入恶意软件列表（malwareName，序列）值（'$title'，'$entry'）“。仅供参考，$entry 等于 MZ�\ 0\0\0\0\0\0\0��\0\0�\0\0\0，但是没有插入，为什么？

Answer 1

您将变量 title 和 entry 直接作为字符串传递，您需要使用 '.' 连接变量操作员 试试这个，可能对你有帮助-

$insertQuery = "INSERT INTO malwarelist (malwareName, sequence) VALUES('".$_POST['mname'].'',''.$entry."')";
if ($conn->query($insertQuery) === TRUE) {
    echo "<br>New record successfully inserted  ".$_POST['mname'];
} else {
    echo "Error: " . $insertQuery. "<br>" . $conn->error;
}

如果发生任何错误，请在此答案中评论该错误

要更改编码，请在本地主机上运行 MySQl 查询

ALTER TABLE malwarelist MODIFY COLUMN sequence VARCHAR(255)  
CHARACTER SET utf8 COLLATE utf8mb4_general_ci NOT NULL;

或

ALTER TABLE malwarelist MODIFY COLUMN sequence VARCHAR(255)  
    CHARACTER SET utf8 COLLATE utf8mb4_unicode_ci NOT NULL;

Answer 2

应该只有下面这样，你不能在插入语句中添加 where 条件。

插入恶意软件列表(malwareName, sequence) 值('$title','$entry')";