PHP將數據發送到無法工作

Question

我設計使用PHP，MySQL的腳本MySQL的腳本，但它不工作 這裏是我的代碼

<?php 
    include('config.php'); 
// table name 
$tbl_name=temp_members_db; 
// Random confirmation code 
$confirm_code=md5(uniqid(rand())); 
    // values sent from form 
    $username=$_POST['username']; 
    $password=$_POST['password']; 
    $email=$_POST['email']; 
    $avatar=$_POST['avatar']; 
    // Insert data into database 
    $sql="INSERT INTO $tbl_name(confirm_code, username, email, password, 
    avatar)VALUES  
    ('$confirm_code', '$username', '$email', '$password', '$avatar')"; 
    $result=mysql_query($sql); 
// if suceesfully inserted data into database, send confirmation link 
    to email 
    if($result){ 
    // ---------------- SEND MAIL FORM ---------------- 
    // send e-mail to ... 
    $to=$email; 
    // Your subject 
    $subject="Your confirmation link here"; 
    // From 
    $header="from: admin <admin@androidhub.netau.net>"; 
    // Your message 
    $message="Your Comfirmation link \r\n"; 
    $message.="Click on this link to activate your account \r\n"; 
    $message.="http://www.andoidhub.netau.net/project/Android% 
    20patched/Forum/confirmation.php?passkey=$confirm_code"; 
    // send email 
    $sentmail = mail($to,$subject,$message,$header); 
    } 
    // if not found 
    else 
    { 
    echo "Not found your email in our database"; 
    } 
    // if your email succesfully sent 
    if($sentmail){ 
    echo "Your Confirmation link Has Been Sent To Your Email 
     Address."; 
     } else{ 
     echo "Cannot send Confirmation link to your e-mail address"; } 
     ?> 

請幫我解決這個問題， 如果您需要了解其他那麼請告訴 這是我的完整代碼。

如果你想看到一個錯誤，那麼請去http://andoidhub.netau.net/project/Android%20patched/Forum/signup_ac.php

Answer 1

如果指定一個字符串變量，不要忘了使用雙蜱（"）或單蜱（'），但我寧願雙重的。如果您正在分配整數，則只能使用不使用勾號。 （即$var = 1;）

$tbl_name = "temp_members_db"; 

然後在您的查詢：

$sql = "INSERT INTO ".$tbl_name." (confirm_code, username, email, password, 
    avatar) VALUES ('$confirm_code', '$username', '$email', '$password', '$avatar')"; 

使用一個變量來查詢之前，一定要至少使用mysql_* real_escape_string功能。

$username = mysql_real_escape_string($_POST["username"]); 

由於大家的建議和意見，使用mysqli_*準備好的聲明或PDO代替過時mysql_*功能。

下面是mysqli_* prepared statement一個例子：

if($stmt = $YourDBConnection->prepare("INSERT INTO ".$tbl_name."(confirm_code, username, email, password, avatar) VALUES (?,?,?,?,?)")){ 
    $stmt->bind_param("sssss",$confirm_code, $_POST["username"], $_POST["email"], $_POST["password"], $_POST["avatar"]); /* BIND VARIABLES TO YOUR QUERY */ 
    $stmt->execute(); /* EXECUTE THE QUERY */ 
    $stmt->close(); /* CLOSE THE QUERY */ 
} /* END OF PREPARED STATEMENT */ 

Answer 2

使用$tbl_name='temp_members_db';因爲PHP中的變量假設是字符串。

，你可以改變的查詢格式

從

$sql="INSERT INTO $tbl_name(confirm_code, username, email, password, 
    avatar)VALUES  
    ('$confirm_code', '$username', '$email', '$password', '$avatar')"; 
    $result=mysql_query($sql); 

要

$sql = "INSERT into $tbl_name set confirm_code='$confirm_code',username='$username',email='$email',password='$password',avatar='$avatar'"; 
$result=mysql_query($sql);