2012-08-27 95 views
0

我有一個奇怪的問題。'插入'後PHP-MySQL數據被交換

我試圖通過一個PHP腳本,進入MySQL的以下數據: 1.到貨(日期) 2.出發(日期) 3.價格(INT 11)

的PHP是以下:

if($_POST['formSubmit'] == "Submit") 
{ 
    $errorMessage = ""; 

    if(empty($_POST['type'])) 
    { 
     $errorMessage .= "<li>Gelieve een type in te voeren!</li>"; 
    } 

    $hotel = $_POST['hotel']; 
    $type = $_POST['type']; 
    $prijs = $_POST['prijs']; 
    $arrival = $_POST['arrival']; 
    $departure = $_POST['departure']; 

    if(empty($errorMessage)) 
    { 

     $sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
         PrepSQL($hotel) . ", ". 
         PrepSQL($type) . ", ". 
         PrepSQL($arrival) . ", ". 
         PrepSQL($departure) . ", ". 
         PrepSQL($prijs) . ")"; 
     mysql_query($sql);   
     include("room-insert.php"); 
     exit(); 
    } 
} 


function PrepSQL($value) 
{ 
    // Stripslashes 
    if(get_magic_quotes_gpc()) 
    { 
     $value = stripslashes($value); 
    } 

    // Quote 
    $value = "'" . mysql_real_escape_string($value) . "'"; 

    return($value); 
} 

和HTML是這樣的:

<form action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>" method="post"> 

     <tr> 
     <p> 
      <label for='hotel'>Hotel</label><br/> 
      <input name="hotel" maxlength="50" value="<?=$naam;?>" /> 
     </p> 
     </tr> 
     <tr> 
     <td> 
     <p> 
      <label for='type'>Type</label><br/> 
      <input type="text" name="type" maxlength="50" value="<?=$type;?>" /> 
     </p> 
     </td> 
     </tr> 


     <tr> 
     <td> 
     <p> 
      <label for='prijs'>Prijs</label><br/> 
      <input type="text" name="prijs" maxlength="50" value="<?=$prijs;?>" /> 
     </p> 
     </td> 
     </tr> 

     <tr> 
     <td> 
     <p> 
      <label for='arrival'>Datum check-in</label><br/> 
      <input type="date" name="arrival" maxlength="50" value="<?=$arrival;?>" /> 
     </p> 
     </td> 
     </tr> 

     <tr> 
     <td> 
     <p> 
      <label for='departure'>Datum check-out</label><br/> 
      <input type="date" name="departure" maxlength="50" value="<?=$departure;?>" /> 
     </p> 
     </td> 
     </tr> 

     <tr> 
     <td> 
        <input type="submit" name="formSubmit" value="Submit" /> 
     </td> 
     </tr> 


    </form> 

我在表單中輸入此: 鐠冰(= prijs):50 到達:2012-09-12 出發:2012-09-30

這導致這樣在MySQL:

價格:2012 到達:2012-09-30 出發:50

因此,徹底搞砸了......

我試過幾件事情,無論是在MySQL,PHP和HTML,都導致相同或更壞,我現在在一個階段,我沒有很更多線索如何解決這個問題...

感謝您的幫助!

大安

+1

無論'PrepSQL'是,這似乎是某種逃生功能的,你不應該使用' mysql_query'在新的應用程序中。您應該使用'mysqli'或PDO並使用[SQL語句佔位符](http://bobby-tables.com/php)確保您的SQL轉義正確且一致地完成。滾動你自己的SQL轉義從來就不是一個好主意。如果你使用了指定的佔位符和'bind_param',這絕不會發生。 – tadman

回答

0

有你的缺陷代碼:

$sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
         PrepSQL($hotel) . ", ". 
         PrepSQL($type) . ", ". 
         PrepSQL($arrival) . ", ". 
         PrepSQL($departure) . ", ". 
         PrepSQL($prijs) . ")"; 

你以錯誤的順序串聯的變量,它應該是這樣的:

$sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
         PrepSQL($hotel) . ", ". 
         PrepSQL($type) . ", ". 
         PrepSQL($prijs) . ")"; 
         PrepSQL($arrival) . ", ". 
         PrepSQL($departure) . ", ". 
+0

哎呀,謝謝!愚蠢的我! – user1627596

0

您的問題似乎是在INSERT SCRIPT部分。

嘗試改變

$sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
    PrepSQL($hotel) . ", ". 
    PrepSQL($type) . ", ". 
    PrepSQL($arrival) . ", ". 
    PrepSQL($departure) . ", ". 
    PrepSQL($prijs) . ")"; 

$sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
    PrepSQL($hotel) . ", ". 
    PrepSQL($type) . ", ". 
    PrepSQL($prijs) . ", ". 
    PrepSQL($arrival) . ", ". 
    PrepSQL($departure) . ")"; 
0

你搞砸值的順序。

你的INSERT:

$sql = "INSERT INTO rooms (hotel, type, prijs, arrival, departure) VALUES (". 
         PrepSQL($hotel) . ", ". 
         PrepSQL($type) . ", ". 
         PrepSQL($arrival) . ", ". 
         PrepSQL($departure) . ", ". 
         PrepSQL($prijs) . ")"; 
  1. 酒店
  2. 類型
  3. 價格
  4. 到達
  5. 出發

按此順序插入數據:

  1. 酒店
  2. 類型
  3. 到達
  4. 出發
  5. 價格