MySQL總是給人SQL語法錯誤

Question

//database class  
class dbmgmt{ 
      public $tbl_name; 
      public $field_arr; 
      public $val_arr; 
      public $cond_arr; 

      function execute($sql){ 
       global $conn; 
       $result=$conn->query($sql); 
       if(!$result) echo "Error: ".$conn->error; 
      } 
      function insert(){ 
       $sql="INSERT INTO ".$this->tbl_name." SET "; 

       for($i=0;$i++;$i<count($this->field_arr)){ 
        if($i!=(count($this->field_arr)-1)){ 
         $sql.=$this->field_arr[i]."=".$this->val_arr.","; 
        }else{ 
         $sql.=$this->field_arr[i]."=".$this->val_arr;     
        } 
       } 

       $this->execute($sql); 
      } 
    } 

    $ado=new dbmgmt(); 

//admin_add.php 
$ado->tbl_name="tbl_admin"; 
$ado->field_arr=array("username","password",'type','email'); 
$ado->val_arr=array($username,create_hash($password),$admin_type,$email); 
       $ado->insert(); 
       if($conn->connect_error){ 
        die("Failed to add Record: ".$conn->connect_errno. ' '.$conn->connect_error); 
       }else{ 

        echo "Succesfully Added Record"; 
        echo "<script>window.location=".ADMIN_PAGE."</script>"; 
       } 

我不斷收到此錯誤：

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1.

我到底做錯了什麼？

Answer 1

的一個問題是，你需要引用字符串值後計數器：

$sql.=$this->field_arr[i]."=\"".$this->val_arr."\""; 

使用mysqli_real_escape_string()或類似的方法需要轉義值

Answer 2

的一個問題是你的for循環：

for($i=0;$i++;$i<count($this->field_arr)){ 
        if($i!=(count($this->field_arr)-1)){ 
         $sql.=$this->field_arr[i]."=".$this->val_arr.","; 
        }else{ 
         $sql.=$this->field_arr[i]."=".$this->val_arr;     
        } 

應與結束標準

for($i=0;$i<count($this->field_arr;$i++)){ 
        if($i!=(count($this->field_arr)-1)){ 
         $sql.=$this->field_arr[i]."=".$this->val_arr.","; 
        }else{ 
         $sql.=$this->field_arr[i]."=".$this->val_arr;     
        }