Mysqli查詢錯誤插入數據到數據庫中

-1

我嘗試向數據庫中插入數據時出錯。所以我做了消息系統。Mysqli查詢錯誤插入數據到數據庫中

下面是代碼：http://pastebin.com/U6SQ907H 這裏是透過代碼：

if(isset($_POST['writemessage'])){ 


    $text = $_POST['text']; 
    $from = $userid; 
    $username = $_POST['username']; 
    //$sql = "SELECT id FROM users WHERE username='$to'"; 
    // $result = mysqli_query($conn,$sql); 
    // $sendto = mysqli_fetch_array($result,MYSQLI_ASSOC); 

    $getuserid = 'SELECT ID FROM users WHERE username = "' . mysqli_escape_string($conn,$username) . '"'; 
    $sqluserid = mysqli_query($conn,$getuserid) or die('Error connecting to database'); 
    //$user_id = mysql_result($result, 0, "user_id"); 
    $user_id = mysqli_fetch_array($sqluserid,MYSQLI_ASSOC); 
    $sendto = $user_id["ID"]; 
    $query_send_mess = "INSERT INTO messages (from, touser, text, date, isread) 
    VALUES ('$from', '$sendto', '$text',NOW(),0)"; 
    echo "<script>alert('".$query_send_mess."')</script>"; 
    $send_message = mysqli_query($conn,$query_send_mess) or die("Error: ".mysqli_error($conn)); 
    if (!$send_message) { 
     echo 'Query Failed '; 
    } 
    if (mysqli_affected_rows($conn) == 1) { //If the Insert Query was successfull. 
     echo '<div class="alert alert-success">Message sent successful </div>'; 
    } else { // If it did not run OK. 
     echo '<div class="alert alert-info">You could not send message due to a system 
     error. We apologize for any 
     inconvenience.</div>'; 
     die(mysqli_error($conn)); 
    } 
}

但是，當我嘗試發送消息我得到這個錯誤：

Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'from, touser, text, date, isread) VALUES ('2', '3', 'test',NOW(),0)' at line 1

可能是什麼問題

來源

2016-02-14 Nauris Linde

from是mysql中的保留關鍵字。您不能像這樣使用它。

嘗試此查詢：

"INSERT INTO messages (`from`, `touser`, `text`, `date`, `isread`) 
     VALUES ('$from', '$sendto', '$text',NOW(),0)"

來源

2016-02-14 19:25:06

From是它無法使用，除非在反引號中的保留期限。您也可以更改列名稱。 https://dev.mysql.com/doc/refman/5.5/en/keywords.html

例如：

$query_send_mess = "INSERT INTO messages (`from`,

你的代碼也開放給SQL注入原樣。您應該使用參數化查詢。

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

來源

2016-02-14 19:25:16 chris85

@NaurisLinde太棒了，請在時間過去後接受答案。也請看準備好的陳述。 – chris85

在這裏你可以看到MySQL的關鍵字，以避免它們 - https://dev.mysql.com/doc/refman/5.7/en/keywords.html –

@NaurisLinde是的，我發佈了一個非常類似的鏈接在我的答案。如果它對你有幫助，請接受答案。 – chris85

Mysqli查詢錯誤插入數據到數據庫中

回答

相關問題