Codeigniter 未将用户添加到数据库

Question

我尝试仅使用 first_name、last_name、username、email 和 password 将用户添加到我的数据库中，并且成功了。

但是，当我尝试添加具有其他值的用户时，例如 $IP 之类的，它不起作用。它只是说

“发生数据库错误”

我的代码在model_user.php

public function insert_user() {

    $first_name = $this->input->post('first_name');
    $last_name = $this->input->post('last_name');
    $username = $this->input->post('username');
    $email = $this->input->post('email');
    $password = $this->input->post('password');
    $IP = "2";
    $total_entry = 1;
    $average_entry = 1;
    $date_of_registration = date("Y-m-d H:i:s");
    $lastactive = date("Y-m-d H:i:s");
    $user_level = 2;
    $account_state = "Active";

//insert data into database. SQL Injection bypass
     $sql = "INSERT INTO users (first_name, last_name, username, email, password, IP, total_entry, average_entry, date_of_registration, lastactive, user_level, account_state )
    VALUES (" . $this->db->escape($first_name) . ",
             " . $this->db->escape($last_name) . ",
             " . $this->db->escape($username) . ",
             '" . $email . "',
             '" . $password . "'
             '" . $IP . "'
             '" . $total_entry . "'
             '" . $average_entry . "'
             '" . $date_of_registration . "'
             '" . $lastactive . "'
             '" . $user_level . "'
             '" . $account_state . "')"; 



$result = $this->db->query($sql);

上面的代码根本不起作用。但是，当我注释掉一些事情时，它会起作用。在注释了几件事之后，此代码有效：

//insert data into database. SQL Injection bypass
     $sql = "INSERT INTO users (first_name, last_name, username, email, password)
    VALUES (" . $this->db->escape($first_name) . ",
             " . $this->db->escape($last_name) . ",
             " . $this->db->escape($username) . ",
             '" . $email . "',
             '" . $password . "')"; 

        /*   '" . $IP . "'
             '" . $total_entry . "'
             '" . $average_entry . "'
             '" . $date_of_registration . "'
             '" . $lastactive . "'
             '" . $user_level . "'
             '" . $account_state . "')";  */

使用上面的代码，用户注册成功。我不知道我做错了什么。

Answer 1

你为什么不使用活动记录？您将大大降低出错的风险。

$data = array(
      'first_name' => $first_name ,
      'last_name' => $last_name ,
      'username' => $username,
      'email' => $email,
      'password' => $password,
      'IP' => $IP,
      'total_entry' => $total_entry,
      'average_entry' => $average_entry,
      'date_of_registration' => $date_of_registration,
      'lastactive' => $lastactive,
      'user_level' => $user_level,
      'account_state' => $account_state
);
 $this->db->insert('tablename', $data);

附带说明，您应该将模型中的数据库调用和提交后的流程分开

控制器：

$data = array(
      'first_name' => $this->input->post('first_name'),
        /*other fields here */
);

$this->my_model->insert_user($data);

型号：

function insert_user($data) 
{
     $this->db->insert("table", $data);
}

更多细节在这里：http://www.codeigniter.com/user_guide/database/active_record.html#insert

Answer 2

出现此错误的原因可能是您在“password”、“IP”、“total_entry”等属性后面缺少逗号。它解释了为什么在您注释这些属性时代码可以工作。