插入兩個日期之間使用數組

Question

$query = sprintf("INSERT INTO dat(empid,empname,reason,date)VALUES\n%s", 

implode(",\n", $values)) 

$query1= real_escape_string($query); 

請幫我對原代碼。我不能插入字符。

Answer 1

首先，總是確保您的數據是安全的。

$emp_id_safe = filter_var($_POST['emp_id'], FILTER_SANITIZE_NUMBER_INT); 
    $emp_name_safe = filter_var($_POST['emp_name'], FILTER_SANITIZE_STRING); 
    $reason_safe = filter_var($_POST['reason'], FILTER_SANITIZE_STRING); 
    $end_date_safe = filter_var($_POST['to_date'], FILTER_SANITIZE_STRING); 

其次，MySQL的PHP​​擴展deprecated，並會在將來被移除。將其替換爲mysqli。

 if ($emp_id_safe == FALSE || $emp_name_safe == FALSE || 
      $reason_safe == FALSE || $end_date_safe == FALSE) { 
      die('Filter failure'); 
     } else { 
      $stmt = $mysqli->prepare("INSERT INTO date(empid, empname, reason, date) VALUES (?, ?, ?, ?)"); 
      $stmt->bind_param("ssss", $emp_id_safe, $emp_name_safe, $reason_safe, $end_date_safe); 
      $stmt->execute(); 
     }