2010-08-18 255 views
1
// write student record 
$query = "INSERT INTO Student (SLastName, SFirstName, SeMail, SGrade, SPhone, SCell, SLunch)". 
" VALUES ($LastName, $FirstName, $email, $grade, $phone, $cell, $lunch)"; 
echo $query . '<br />'; 
$result = mysql_query($query); 
if (!$result) 
    die("Error inserting Student record: ". mysql_error()); 

INSERT INTO Student (SLastName, SFirstName, SeMail, SGrade, SPhone, SCell, SLunch) 
VALUES (Weiner, Wendy, [email protected], 12, 2123334444, 8458765555, 5) 

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@gmail.com, 12, 2123334444, 8458765555, 5)' at line 1插入一個電子郵件地址

Server版本表字段:5.0.91社區

回答

1

您從little Bobby Tables通過邀請訪問用戶提供在SQL查詢中未轉義的數據。

要麼使用mysql_real_escape_string來定義輸入,要麼使用PDO來做得更好。

0

難道不該

INSERT INTO Student (SLastName, SFirstName, SeMail, SGrade, SPhone, SCell, SLunch) 
VALUES (Weiner, Wendy, '[email protected]', 12, 2123334444, 8458765555, 5) 

我。即與電子郵件地址在引號?

+0

你需要加上引號過其他琴絃(雖然誰downranked你是作爲一個有點意思。) – fredley 2010-08-19 18:57:35

0

您需要包住引號你的價值觀:

$query = "INSERT INTO Student (SLastName, SFirstName, SeMail, SGrade, SPhone, SCell, SLunch)". " VALUES ('$LastName','$FirstName','$email', '$grade', '$phone', '$cell', '$lunch')";

+0

葉,我想也知道。另一個答案,似乎有點苛刻。 – fredley 2010-08-19 18:57:07

相關問題