使用MYSQLI插入时出错

Question

我是这个PHP的新手，请帮助我，我无法在表中插入值。但是，如果我直接给insert命令代替变量，它就可以工作。

<?php
include ("db.php"); 
$msg = "";
if(isset($_POST["submit"]))
{
    $name = $_POST["name"];
    $email = $_POST["email"];
    $password = $_POST["password"];
    $name = mysqli_real_escape_string($db, $name);
    $email = mysqli_real_escape_string($db, $email);
    $password = mysqli_real_escape_string($db, $password);
    $password = md5($password);
    $sql="SELECT email FROM users2 WHERE email='$email'";
    $result=mysqli_query($db,$sql);
    $row=mysqli_fetch_array($result,MYSQLI_ASSOC);
    if(mysqli_num_rows($result) == 1)
    {
        $msg = "Sorry...This email already exist...";
    }
    else
    {
        $query = mysqli_query($db, "INSERT INTO users2 (name, email, password)VALUES ('$name', '$email', '$password')");
        if($query)
        {
            $msg = "Thank You! you are now registered.";
        }
    }
}
?>

Answer 1

$sql = "INSERT INTO users2 (name, email, password) VALUES (?,?,?)";
            if (!$stmt = $db->prepare($sql)) {
            die($db->error);
            }
            $stmt->bind_param("sss", $name, $email, $password);
            if (!$stmt->execute()) {
            die($stmt->error);
            }

我不知道上面的问题是什么问题但是我使用了上面的查询而不是我使用过的问题和Boom它是成功的。如果你们其中任何一个人知道问题中的问题，请告诉我。

Answer 2

你必须在insert的字符串中连接变量而不仅仅是作为变量

$query = mysqli_query($db,"INSERT INTO users2 (name, email, password)VALUES ('".$name."', '".$email."', '".$password."')")

要么

$query = mysqli_query($db,"INSERT INTO users2 (name, email, password)VALUES ('{$name}', '{$email}', '{$password}')")

你应该为这个mysql_real_escape_string-versus-Prepared-Statements使用prepare语句

切勿使用md5() is-md5-considered-insecure

更喜欢password_hash()或password_verify() Manuel

``