使用json更新mysql數據庫空白字段

Question

我試圖插入記錄到MySQL數據庫但字段爲空。這裏是我的JS：

$("#submit").click(function() { 
    var product1name  = $("input#product1name").val(); 
    var product2name  = $("input#product2name").val(); 
    var product3name  = $("input#product3name").val(); 
    var product4name  = $("input#product4name").val(); 
    var product5name  = $("input#product5name").val(); 
    var product1quantity = $("input#product1quantity").val(); 
    var product2quantity = $("input#product2quantity").val(); 
    var product3quantity = $("input#product3quantity").val(); 
    var product4quantity = $("input#product4quantity").val(); 
    var product5quantity = $("input#product5quantity").val(); 

    var dataString = 'product1name='+ product1name + 'product2name=' + product2name + 'product3name=' + product3name + 'product4name=' + product4name + 'product5name=' + product5name + 'product1quantity='+ product1quantity + 'product2quantity='+ product2quantity + 'product3quantity='+ product3quantity + 'product4quantity='+ product4quantity + 'product5quantity='+ product5quantity + 'salesid='+ salesid + 'email='+ email + 'wpuseremail='+ wpuseremail; 

    $.ajax({ 
     type: "POST", 
     url: "process.php", 
     data: dataString, 
     success: function(json) { 
     $('#contact_form').html("<div id='message'></div>"); 
     $('#message').html(json.type) 
     .append(json.message) 
     .hide() 
     .fadeIn(1500, function() { 
      $('#message').append("<img id='checkmark' src='images/check.png' />"); 
     }); 
     } 
    }); 
    return false; 

}); 

這裏是我的PHP：

<?php 
$product1quantity = $_POST["product1quantity"]; 
$product2quantity = $_POST["product2quantity"]; 
$product3quantity = $_POST["product3quantity"]; 
$product4quantity = $_POST["product4quantity"]; 
$product5quantity = $_POST["product5quantity"]; 

$username = "user"; 
$password = "pass"; 
$hostname = "host"; 

$dbhandle = mysql_connect($hostname, $username, $password) 
or die("Unable to connect to MySQL"); 

$selected = mysql_select_db("dbname",$dbhandle) 
    or die("Could not select dbname"); 

$result = "INSERT INTO dbname.tablename (product1name, product2name, product3name, product4name, product5name, product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, id) VALUES ('', '', '', '', '', product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, NULL)"; 
mysql_query($result); 

mysql_close($dbhandle); 

$response = array('type'=>'', 'message'=>''); 
$response['type'] = 'success'; 
$response['message'] = 'Thank-You for submitting the form!'; 
print json_encode("success"); 
?> 

我已經證實了它的工作原理，當我不使用INSERT語句中的變量，而是硬編碼值。我的變量有點不對勁。

Answer 1

看來你所謂的變量犯規在他們面前有$ ..

看到

$result = "INSERT INTO dbname.tablename (product1name, product2name, product3name,  product4name, product5name, product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, id) VALUES ('', '', '', '', '', $product1quantity, $product2quantity, $product3quantity, $product4quantity, $product5quantity, NULL)"; 

但請修復您的代碼，因爲它是高風險的直接原因是SQL的POST變量插入注入安全漏洞

您可以考慮使用像PDO預處理語句或mysqli的

在這裏閱讀更多：http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/

Answer 2

我想你錯過了你的變量（$）的美元符號。

你應該寫：

$result = " 
    INSERT INTO dbname.tablename (
     product1name, 
     product2name, 
     product3name, 
     product4name, 
     product5name, 
     product1quantity, 
     product2quantity, 
     product3quantity, 
     product4quantity, 
     product5quantity, 
     id 
    ) VALUES (
     '', 
     '', 
     '', 
     '', 
     '', 
     $product1quantity, 
     $product2quantity, 
     $product3quantity, 
     $product4quantity, 
     $product5quantity, 
     NULL 
    ) 
";