-2
我正在嘗試創建PHP/MySQL事件日曆。然而它並不完全正確。下面是我的代碼：無法將數據插入到MySQL事件數據庫中
// calender.php
$servername = "localhost";
$username = "username";
$password = "";
// Create connection
$conn = mysqli_connect($servername, $username, $password);
// Check connection
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}
@mysqli_select_db("calen");
if ([email protected]_select_db) {
die("database connection failed".mysqli_connect_error());
}
/*
mysqli_connect($hostname,$username,$password) or die ($error);
mysqli_select_db($dbname) or die ($error);
*/
?>
<html>
<head>
<script>
function lastmonth(month,year) {
if (month == 1) {
--year;
month = 13;
}
--month
var monthstring= ""+month+"";
var monthlength = monthstring.length;
if (monthlength <=1) {
monthstring = "0" + monthstring;
}
document.location.href = "<?= $_SERVER['PHP_SELF'];?>?month="+monthstring+"&year="+year;
}
function nextmonth(month,year) {
if(month == 12) {
++year;
month = 0;
}
++month
var monthstring= ""+month+"";
var monthlength = monthstring.length;
if (monthlength <=1) {
monthstring = "0" + monthstring;
}
document.location.href = "<?=$_SERVER['PHP_SELF'];?>?month="+monthstring+"&year="+year;
}
</script>
</head>
<body>
<?php
if (isset($_GET['day'])) { //to pass variable
$day = $_GET['day'];
} else {
$day = date("j");
}
if (isset($_GET['month'])) {
$month=$_GET['month'];
} else {
$month = date("n");
}
if (isset($_GET['year'])) {
$year=$_GET['year'];
} else {
$year = date("y");
}
$currentTimeStamp = strtotime("$year-$month-$day");
$monthname = date("F", $currentTimeStamp);
$numofdays = date("t", $currentTimeStamp);
$counter = 0;
?>
<?php
if (isset($_GET['add'])) {
$title =$_POST['txttitle'];
$detail =$_POST['txtdetail'];
$eventdate = $month."/".$day."/".$year;
$insert = "INSERT into calendar(Title,Detail,EventDate,DateAdded) values ('".$title."','".$detail."','".$eventdate."',now())";
$check = mysqli_query($conn,$insert);
if ($check) {
echo "Event Added...";
} else {
echo "Failed....";
}
}
?>
<table border='1'>
<tr>
<td><input style='width:50px;' type='button' value='<' name='previous' onclick="lastmonth(<?php echo $month.",".$year ?>)"> </td>
<td colspan='5' align='center'> <?php echo $monthname.",".$year ?> </td>
<td><input style='width:50px;' type='button' value='>' name='next' onclick="nextmonth(<?php echo $month.",".$year ?>)"></td>
</tr>
<tr>
<td width='50px' align='center'>Sun</td>
<td width='50px'align='center'>Mon</td>
<td width='50px'align='center'>Tue</td>
<td width='50px'align='center'>Wed</td>
<td width='50px'align='center'>Thu</td>
<td width='50px'align='center'>Fri</td>
<td width='50px'align='center'>Sat</td>
</tr>
<?php
echo "<tr>";
for ($i=1;$i<$numofdays+1;$i++,$counter++) {
$TimeStamp = strtotime("$year-$month-$i");
if ($i == 1) {
$firstday = date("w", $TimeStamp); //which day 1 falls on
for ($j = 0; $j < $firstday; $j++, $counter++) {
echo "<td> </td>";
}
}
if ($counter % 7 == 0) {
echo "</tr><tr>";
}
$monthstring=$month;
$monthlength=strlen($monthstring);
$daystring=$i;
$daylength=strlen($daystring);
if ($monthlength<=1) {
$monthstring = "0".$monthstring;
}
if ($daylength<=1) {
$daystring="0".$daystring;
}
echo "<td align='center'> <a href='".$_SERVER['PHP_SELF']."?month=".$monthstring."&day=".$daystring."&year=".$year."&v=true'>".$i."</a> </td>";
}
echo "</tr>";
?>
</table>
<?php
if (isset($_GET['v'])) {
echo "<a href='".$_SERVER['PHP_SELF']."?month=".$monthstring."&day=".$daystring."&year=".$year."&v=true&f=true'>Add Event </a>";
if (isset($_GET['f'])) {
include("event.php");
}
}
?>
</body>
</html>
event.php
<form name='event' method='POST' action="<?php $_SERVER['PHP_SELF']; ?>?month=<?php echo $month;?>&day=<?php echo $day;?>&year=<?php echo $year; ?>&v=true&add=true">
<table width='400px' border='0'>
<tr>
<td width='150px'>Title</td>
<td width='250px'><input type='text' name='txttitle'</td>
</tr>
<tr>
<td width='150px'>Detail</td>
<td width='250px'><textarea name='txtdetail'></textarea></td>
</tr>
<tr>
<td colspan='2' align='center'><input type='submit' name='btnadd' value='Add Event'></td>
</tr>
</table>
</form>
SQL：
CREATE TABLE `calendar` (
`ID` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`Title` VARCHAR(65) NOT NULL ,
`Detail` VARCHAR(255) NOT NULL ,
`EventDate` VARCHAR(10) NOT NULL ,
`DateAdded` DATE NOT NULL
);
我無法將數據插入到數據庫中。我粘貼了我的calendar.php，event.php和SQL代碼。請檢查代碼並幫助我插入數據。
**警告**：使用'mysqli'時，應該使用參數化查詢和['bind_param']（http://php.net/manual/en/mysqli-stmt.bind- param.php）將用戶數據添加到您的查詢中。 **不要**使用字符串插值或連接來完成此操作，因爲您創建了嚴重的[SQL注入漏洞]（http://bobby-tables.com/）。 **絕不**將'$ _POST'或'$ _GET'數據直接放入查詢中，如果有人試圖利用您的錯誤，這會非常有害。 – tadman