PHP PDO錯誤1064

Question

我有一個小問題，當我提出我的論壇數據我得到這個錯誤：

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Explain, Country, IP, Hostname)

我的代碼是這樣的：

  $STH = $DBH->prepare("INSERT INTO `Applications` (`Username`, `Email`, `Age`, `Reason`, `Explain`, `Country`, `IP`, `Hostname`) VALUES ($username, $email, $age, $reason, $explain, $country, $ip, $hostname)"); 
     $STH->execute();

我不能似乎找到了問題。

Answer 1

你沒有正確使用PDO，創造大量的SQL注入的問題。放入SQL的值需要正確轉義。

的placeholder method使然做這種方式：

$STH = $DBH->prepare("INSERT INTO `Applications` (`Username`, `Email`, `Age`, `Reason`, `Explain`, `Country`, `IP`, `Hostname`) VALUES (:username, :email, :age, :reason, :explain, :country, :ip, :hostname)"); 
$STH->bindParam(':username', $username); 
$STH->bindParam(':email', $email); 
... (remaining columns) .. 
$STH->bindParam(':hostname', $hostname); 
$STH->execute(); 

這是爲了確保你的SQL是properly escaped的最佳途徑。