PHP語法錯誤

Question

我一直在試圖讓下面的查詢權的語法，但它不斷生成語法錯誤

代碼示例

$_SESSION['FN'] = "FirstName"; 
$_SESSION['LN'] = "LastName"; 
$_SESSION['Code'] = 1; 
$strSql = "INSERT INTO BookingInformation (FirstName,LastName,Code) VALUES("'.$_SESSION['FN'].'","'.$_SESSION['LN'].'",'.$_SESSION['Code'].')"; 

我想要存儲的字符串和整數值，但插入聲明生成語法

Answer 1

這句話是壞， 正確的形式是：

/* i don't need this!!! 
    $_SESSION['FN'] = "FirstName"; 
    $_SESSION['LN'] = "LastName"; 
    $_SESSION['Code'] = 1; 
*/ 
    $strSql = "INSERT INTO BookingInformation (FirstName) VALUES("'.$_SESSION['FN'].'")"; 

o如果表BookingInformation的字段是例如名字，姓氏和代碼，您可以插入 ：

$strSql = "INSERT INTO BookingInformation (FirstName,LastName,Code) VALUES("'.$_SESSION['FN'].'","'.$_SESSION['LN'].'",'.$_SESSION['Code'].')"; 

如果你有一些空值，你可以這樣做：

$strSql = "INSERT INTO BookingInformation VALUES("'.$_SESSION['FN'].'",'','')"; 

Answer 2

你引用是錯誤的，如

VALUES("' 

應

VALUES('" 

Answer 3

嘗試這樣的：

$strSql = "INSERT INTO BookingInformation (FirstName, LastName, Code) VALUES('" . $_SESSION['FN'] . "', '" . $_SESSION['LN']. "','" . $_SESSION['Code'] . "')"; 

而且你的代碼是vulnrable到SQL Injection。

Answer 4

的問題是'是的「」請嘗試以下方法中：

$strSql = "INSERT INTO BookingInformation (FirstName) VALUES ('".$_SESSION['FN']."', '".$_SESSION['LN']."', '".$_SESSION['Code']."')"; 

您還試圖插入3個值成一排，不能像上面來完成，它應該是（僞代碼）：

INSERT INTO table (column1, column2, column3) VALUES ($data1, $data2, $data3); 

或者你的情況：

$strSql = "INSERT INTO BookingInformation (FirstName, LastName, Code) VALUES ('".$_SESSION['FN']."', '".$_SESSION['LN']."', '".$_SESSION['Code']."')"; 

最後你的代碼似乎是不安全因爲會話可能被篡改，更好地用準備好的查詢確保所有輸入或mysql_real_escape_string()

Answer 5

嘗試

$strSql = "INSERT INTO BookingInformation (FirstName, LastName, Code) VALUES('".$_SESSION['FN']."', '".$_SESSION['LN']."', '".$_SESSION['Code']."')";