如何修复我的预订，因为当我发送它时。它没有在 mysql 上显示任何数据

Question

我正在设置我的预订 Web 应用程序并支持 UTF-8。

我已经在运行 PHP 7 和 MySQL 以及 Apache 2。过去我尝试过做注册表单和登录表，当我做预订表时似乎最终发送回显“失败”。

我正在使用面向对象的方法做 php

这是我的bookingtest.php

<?php

$php_variable = 'string';

// connection

include ('config.php');

ob_start();  

// if button register pressed

if(isset($_POST['book']))

{

$fname = $_POST['fname'];

$email = $_POST['email'];

$phone = $_POST['phone'];

$country = $_POST['country'];

$swimming = $_POST['swimming'];

$date = $_POST['date'];

$numbercus= $_POST['numbercus'];

$suits= $_POST['suits'];

$certificate = $_POST['certificate'];

$guide= $_POST['guide'];

//inserting php form to mysql

$sql_book = "INSERT INTO booking (fname, email, phone, country, swim, 

date, num, suits, cert, guide)

VALUES ('$fname', '$email', '$phone', '$country', $swimming, '$date', 

'$numbercus', '$suits', '$certificate', '$guide')";

//result

if ($result_book = $conn->query($sql_book))

{

    sleep(1);

    echo "success";

}

else

{

    echo "Failed ! Please check your details !";

}

}

?>

Answer 1

使用execute代替query和使用准备好的语句来处理 SQL INJECTION。$sql = "INSERT INTO booking (fname, email, phone, country, swim, date, num, suits, cert, guide) VALUES (?,?,?,?,?,?,?,?,?,?)";$stmt= $pdo->prepare($sql);$stmt->execute([$fname, $email, $phone, $country, $swimming, $date, $numbercus, $suits, $certificate, $guide]);