我的 SQL 插入代码有什么问题？

Question

我正在努力找出为什么这段代码不适合我。我有表：albums (albumid, albumname)、composers (composerid, composername) 和 tracks (trackid, tracktitle, albumid, composerid)。

当我使用我的表单添加曲目并将其链接到作曲家和专辑时：

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<p>Enter the new track:<br />
<textarea name="tracktitle" rows="1" cols="20"></textarea></p>
<p>Composer:    <select name="cid" size="1">
<option selected value="">Select One</option>
<option value="">---------</option>
<?php     while ($composer= mysql_fetch_array($composers)) {
 $cid = $composer['composerid'];
 $cname = htmlspecialchars($composer['composername']);
 echo "<option value='$cid'>$cname</option>\n";} ?>
 </select></p>
 <p>Place in albums:<br />
 <?php      while ($alb = mysql_fetch_array($albs)) {
  $aid = $alb['albumid'];
  $aname = htmlspecialchars($alb['albumname']);
  echo "<label><input type='checkbox' name='albs[]' 
  value='$aid' />$aname</label><br />\n";
  } ?>
  </p>
  <input type="submit" value="SUBMIT" />
  </form>
  <?php endif; ?>

我收到这条消息：

添加了新曲目
将曲目插入专辑 2 时出错：
曲目已添加到 0 个专辑。

表单前面的php代码是：

if (isset($_POST['tracktitle'])): 
 // A new track has been entered
 // using the form.
$tracktitle = mysql_real_escape_string($tracktitle);
$cid= $_POST['cid'];
$tracktitle = $_POST['tracktitle'];
$albs = $_POST['albs'];
if ($cid == '') {
exit('<p>You must choose an composer for this track. Click 

“返回”并重试。

');}

$sql = "INSERT INTO tracks (tracktitle)
 VALUES ('$tracktitle')" ;
if (@mysql_query($sql)) {
echo '<p>New track added</p>';
 } else {
exit('<p>Error adding new track' . mysql_error() . '</p> 
echo mysql_error() ');}
$trackid = mysql_insert_id();
if (isset($_POST['albs'])) {
$albs = $_POST['albs'];
} else {
$albs = array();
}
$numAlbs = 0;
foreach ($albs as $albID) {
$sql = "INSERT IGNORE INTO tracks (trackid, albumid, 
composerid) VALUES " .
"($trackid, $albs, $cid)";
if ($ok) {
  $numAlbs = $numAlbs + 1;
} else {
  echo "<p>Error inserting track into album $albID: " .
      mysql_error() . '</p>';    }}?>
<p>Track was added to <?php echo $numAlbs; ?> albums.</p>

<?php
else: // Allow the user to enter a new track
$composers = @mysql_query('SELECT composerid, composername 
FROM composers');
if (!$composers) {
 exit('<p>Unable to obtain composer list from the database.</p>');
}
$albs = @mysql_query('SELECT albumid, albumname FROM albums');
if (!$albs) {
  exit('<p>Unable to obtain album list from the database.</p>');}?>

我一直在寻找失败的原因，并且一直在碰壁。我也知道目前它不是很安全，这将是我接下来要解决的问题。我只想让实际功能首先工作。

Answer 1

@paj：改变

if ($ok) {

到

if (mysql_query($sql)) {

-

我还建议您将 SQL 语句更新为

$sql = "INSERT INTO tracks (tracktitle) VALUES ('" . $tracktitle . "')";

$sql = "INSERT IGNORE INTO tracks (trackid, albumid, composerid) VALUES (" . $trackid . ", " . $albID . ", " . $cid . ")";

Answer 2

在我看来$ok 不存在，除了if ($ok) { 线。它需要事先在某个地方定义，否则它总是会读取为 false，因为它不存在。

实际上，您可以跳过不存在的 $ok 并像上面那样为该行输入if (@mysql_query($sql)) {。我确实必须同意 cmets 的代码需要一些爱，但如果你想知道它为什么会崩溃，看来这就是原因。