意外的錯誤消息在PHP表單（SQL語法錯誤）

Question

我已經做了一個簡單的PHP數據庫的cms表單，但它不能正常工作，當我想提交表單與一些虛擬數據！我不知道爲什麼會發生&也是我加入了mysqli_error()得到錯誤的，我現在面臨與類型，但我只拿到了這一點：

您的SQL語法錯誤;檢查對應於你的MySQL服務器版本正確的語法使用手動近「」，「」，「在行」）」 2

<?php 
if (isset($_POST['submit'])){ 
    $post_title = $_POST['title']; 
    $post_date = date('d-m-y'); 
    $post_author = $_POST['author']; 
    $post_keywords = $_POST['keywords']; 
    $post_content = $_POST['content']; 
    $post_image = $_FILES['image']['name']; 
    $image_tmp = $_FILES['image']['tmp_name']; 

    if ($post_title=='' or $post_keywords='' or $post_content='' or $post_author=''){ 
     echo '<script>alert("Some fields are missing")</script>'; 
    }else{ 
     move_uploaded_file($image_tmp,"post_images/$post_image"); 
     $insert_query = "INSERT INTO posts 
     (post_title,post_date,post_author,post_image,post_keywords,post_content) VALUES ('$post_title','$post_date','$post_author',$post_image','$post_keywords','$post_content')"; 
     $insert_post = mysqli_query($con,$insert_query); 
     if ($insert_post){ 
      echo '<h3 style="color:green">Post has been added successfully.</h3>'; 
     }else{ 
      echo mysqli_error($con); 
     } 
    } 
} 
?> 
<form method="POST" action="" enctype="multipart/form-data"> 
    <table width="600" align="center" border="10"> 
     <tr> 
      <td align="center"><h6>Insert Post Title</h6></td> 
      <td align="center"><input type="text" name="title"/></td></br> 
     </tr> 
     <tr> 
      <td align="center"><h6>Insert Post Author</h6></td> 
      <td align="center"><input type="text" name="author"/></td></br> 
     </tr> 
     <tr> 
      <td align="center"><h6>Insert Post Keywords</h6></td> 
      <td align="center"><input type="text" name="keywords"/></td></br> 
     </tr> 
     <tr> 
      <td align="center"><h6>Insert Post Image</h6></td> 
      <td align="center"><input type="file" name="image"/></td></br> 
     </tr> 
     <tr> 
      <td align="center"><h6>Insert Post Content</h6></td> 
      <td align="center"><textarea name="content" cols="10" rows="10"></textarea></td></br> 
     </tr> 
     <tr> 
      <td align="center"><input type="submit" name="submit" value="Submit"/></td> 
     </tr> 
    </table> 
</form> 

如果您分享您的解決方案這將是對我很有幫助對於這個問題...謝謝！

Answer 1

你缺少一個報價之前$ post_image：

,$post_image' 

應該是：

,'$post_image' 

所以完整的SQL語句就變成了：

$insert_query = "INSERT INTO posts 
    (post_title, post_date, post_author, post_image, post_keywords, post_content) 
    VALUES ('$post_title', '$post_date', '$post_author', '$post_image', 
      '$post_keywords', '$post_content')"; 

請注意你在做這個的任務：

if ($post_title=='' or $post_keywords='' or $post_content='' or $post_author=''){ 

您應該使用的雙==代替=。

最後，您的代碼容易受到SQL injection的影響。所以請使用參數prepared statements。

Answer 2

的寫作這樣的語句是更好的

// this not always works 
if ($post_title=='' or $post_keywords='' or $post_content='' or $post_author=''){ 
     echo '<script>alert("Some fields are missing")</script>'; 
    } 

// yeah much better 
if (empty($post_title) || empty($post_keywords) || empty($post_content) || empty($post_author)){ 
      echo '<script>alert("Some fields are missing")</script>'; 
     } 

和SQL錯誤最可能是因爲這裏

'$post_keywords','$post_content')"; 

$post_keywords和$post_content爲空或空

Answer 3

變化

1. 使用empty進行檢查空變量
2. 使用||而不是or
3. 你在做什麼檢查驗證。（move_uploaded_file）
4. 小心引號（$post_image'） - 這是你的代碼的bug
5. 增強mysqli_error（if (!$insert_post){）

代碼

<?php 
    if (isset($_POST['submit'])) 
    { 
     $post_title = $_POST['title']; 
     $post_date = date('d-m-y'); 
     $post_author = $_POST['author']; 
     $post_keywords = $_POST['keywords']; 
     $post_content = $_POST['content']; 
     $post_image = $_FILES['image']['name']; 
     $image_tmp = $_FILES['image']['tmp_name']; 

     if (empty($post_title) || empty($post_keywords) || empty($post_content) || empty($post_author)) 
     { 
      echo '<script>alert("Some fields are missing")</script>'; 
     } 
     else 
     { 
      if (!move_uploaded_file($image_tmp,"post_images/$post_image")) { 
       echo "Move Failed"; 
      } 
      else 
      { 
       $insert_query = "INSERT INTO posts (post_title,post_date,post_author,post_image,post_keywords,post_content) VALUES ('$post_title','$post_date','$post_author','$post_image','$post_keywords','$post_content')"; 
       $insert_post = mysqli_query($con,$insert_query); 

       if (!$insert_post){ 
        echo mysqli_error($con); 
       } 
       else 
       { 
        echo '<h3 style="color:green">Post has been added successfully.</h3>'; 
       } 
      } 

     } 
    } 
?>