2013-12-09 223 views
0

我試圖將信息輸入到數據庫,同時將文件上傳到服務器並將其鏈接存儲在數據庫中。此時文件上傳,但是沒有表單數據顯示在數據庫中,並返回表單無法提交的錯誤消息,但實際上並未指定錯誤。表單不提交到數據庫

任何幫助將是驚人的!

<?php 

$dbc=mysql_connect('localhost', 'mgertenbach', 'mollyr'); 
mysql_select_db('mgertenbach', $dbc); 


if($_SERVER['REQUEST_METHOD']=='POST'){ 
    //you needed to move this INSIDE the conditional.. you had it up at line 15 which... woudl cause the errors to show. 
    $sqlInsertString = "INSERT INTO band_information 
      VALUES ('{$_POST['bandname']}', '{$_FILES['bandphoto']['name']}', '{$_POST['bandbio']}', '{$_POST['bandcity']}', '{$_POST['bandstate']}', '{$_POST['bandzipcode']}', '{$_POST['bandgenre']}', '{$_POST['bandlink']}');"; 

    if(move_uploaded_file($_FILES['bandphoto']['tmp_name'], "C:\\HTML\\mgertenbach\\BAND\\photos\\{$_FILES['bandphoto']['name']}") && @mysql_query($sqlinsertString, $dbc)){ 
     print '<p>Thanks for submitting your band!</p>'; 
    } else { 
     print '<p>Could not submit band because: <br/>' . 
     mysql_error($dbc) . '</p>'; 
    } 
}     



?> 

    <h3>Please fill out the following information.</h3> 

    <form action="submitband.php" method="post" enctype="multipart/form-data"> 
     <fieldset><legend>Who Are You?</legend> 
      <label>Band Name: <input type="text" name="bandname" size="10"/></label> 
      <br/><br/> 

      <label>Link to Photo*: <input type="hidden" name="MAX_FILE_SIZE" value="300000" /><input type="file" id="bandphoto" name="bandphoto" /></label> 
      <br/>&nbsp;&nbsp;&nbsp;*image must be a square file 
      <br/><br/> 
      <label>Enter a short bio: <br/><textarea name="bandbio" cols="40" rows="10"></textarea></label> 
     </fieldset> 
     <br/><br/> 
     <fieldset><legend>Where Are You From?</legend> 
      <label>City: <input type="text" name="bandcity" size="10"/></label> 
      <br/><br/> 
      <label>State: 
       <select id="bandstate" name="bandstate"> 
         <option value=""> </option> 
         <option value="AL">Alabama</option> 
         <option value="AK">Alaska</option> 
         <option value="AZ">Arizona</option> 
         <option value="AR">Arkansas</option> 
         <option value="CA">California</option> 
         <option value="CO">Colorado</option> 
         <option value="CT">Connecticut</option> 
         <option value="DE">Delaware</option> 
         <option value="DC">District Of Columbia</option> 
         <option value="FL">Florida</option> 
         <option value="GA">Georgia</option> 
         <option value="HI">Hawaii</option> 
         <option value="ID">Idaho</option> 
         <option value="IL">Illinois</option> 
         <option value="IN">Indiana</option> 
         <option value="IA">Iowa</option> 
         <option value="KS">Kansas</option> 
         <option value="KY">Kentucky</option> 
         <option value="LA">Louisiana</option> 
         <option value="ME">Maine</option> 
         <option value="MD">Maryland</option> 
         <option value="MA">Massachusetts</option> 
         <option value="MI">Michigan</option> 
         <option value="MN">Minnesota</option> 
         <option value="MS">Mississippi</option> 
         <option value="MO">Missouri</option> 
         <option value="MT">Montana</option> 
         <option value="NE">Nebraska</option> 
         <option value="NV">Nevada</option> 
         <option value="NH">New Hampshire</option> 
         <option value="NJ">New Jersey</option> 
         <option value="NM">New Mexico</option> 
         <option value="NY">New York</option> 
         <option value="NC">North Carolina</option> 
         <option value="ND">North Dakota</option> 
         <option value="OH">Ohio</option> 
         <option value="OK">Oklahoma</option> 
         <option value="OR">Oregon</option> 
         <option value="PA">Pennsylvania</option> 
         <option value="RI">Rhode Island</option> 
         <option value="SC">South Carolina</option> 
         <option value="SD">South Dakota</option> 
         <option value="TN">Tennessee</option> 
         <option value="TX">Texas</option> 
         <option value="UT">Utah</option> 
         <option value="VT">Vermont</option> 
         <option value="VA">Virginia</option> 
         <option value="WA">Washington</option> 
         <option value="WV">West Virginia</option> 
         <option value="WI">Wisconsin</option> 
         <option value="WY">Wyoming</option> 
        </select></label> 
      <br/><br/> 
      <label>Zipcode: <input type="text" name="bandzipcode" size="10"/></label> 
     </fieldset> 
     <br/><br/> 
     <fieldset><legend>What's Your Music Like?</legend> 
      <label>Genre: 
       <select name="bandgenre"> 
         <option value="country">Country</option> 
         <option value="electronic">Electronic</option> 
         <option value="folk">Folk</option> 
         <option value="indie">Indie</option> 
         <option value="punk">Punk</option> 
         <option value="rock">Rock</option> 
       </select> 
       </label> 
      <br/><br/> 
      <label>Share a link to where we can hear it: <input type="text" name="bandlink" size="40"/></label> 
     </fieldset> 
     <br/><br/> 
     <input type="submit" value="submit"/>   
    </form> 
+0

轉義您的值,以避免SQL注入 –

+1

此外,可能不是一個好主意,您的用戶名和密碼廣播到數據庫。 – sbeliv01

回答

0
  1. 爲什麼你有花括號這樣'{$_POST['bandname']}'

    這是PHP不是BASH所以擺脫他們。

  2. 但實際上並沒有指定錯誤

    從 @mysql_query刪除@看到錯誤

  3. 您的代碼容易受到SQL注入作爲 評論使用中指出參數化查詢或PDO

0

首先,刪除@ beforre mysql_query會得到你的錯誤信息。你也有單引號的兩層你的代碼,這永遠不會返回任何結果:

$sqlInsertString = "INSERT INTO band_information 
      VALUES ('{$_POST['bandname']}', '{$_FILES['bandphoto']['name']}', '{$_POST['bandbio']}', '{$_POST['bandcity']}', '{$_POST['bandstate']}', '{$_POST['bandzipcode']}', '{$_POST['bandgenre']}', '{$_POST['bandlink']}');"; 

而且,你不列表中的字段中,你將插入?不是問題,請確保每個值符合所需的字段類型,否則查詢將失敗。 你有修正SQL的方式有兩種:事先分配給每個值,然後使用它們:

$bandname = $_POST['bandname']; 
$sqlInsertString = "INSERT INTO band_information VALUES ('$bandname', // etc 

或得到你的雙引號然後把變量:

$sqlInsertString = "INSERT INTO band_information VALUES ('" . $_POST['bandname'] . "','" . $_FILES['bandphoto']['name'] . "','" . $_POST['bandbio'] . "','" . $_POST['bandcity'] . "','" . $_POST['bandstate'] . "','" . $_POST['bandzipcode'] . "','" . $_POST['bandgenre'] . "','" . $_POST['bandlink'] . "')"; 

哦...和我不知道爲什麼有大括號?從來沒有使用過的SQL ..

這一點,如果是很難調試

if(move_uploaded_file($_FILES['bandphoto']['tmp_name'], "C:\\HTML\\mgertenbach\\BAND\\photos\\{$_FILES['bandphoto']['name']}") && @mysql_query($sqlinsertString, $dbc)) 

這將具有相同的行爲,如果SQL故障,或者如果move_uploaded_file失敗。移動文件是臭名昭着的婊子,因爲所有這些權限問題。也許嘗試那些:

if (mysql_query($sqlInsertString)) 
{if (move_uploaded_file($_FILES['bandphoto']['tmp_name'], "C:\\HTML\\mgertenbach\\BAND\\photos\\{$_FILES['bandphoto']['name']}")) 
    {echo 'both worked!';}} 
    else 
    {echo 'only the query worked';} 
else 
{echo 'the query failed';}