时间戳

首页 > 解决方案 > 如何通过 SQL 选择要保存到的数据库

php - 如何通过 SQL 选择要保存到的数据库

问题描述

我想创建一个登录屏幕，用户可以通过单选按钮根据他们的职业选择要保存到哪个数据库。我已经解决了大多数错误，但这些错误：

注意：未定义变量：第 34 行 C:\xampp\htdocs\project\save.php 中的 sqlinsert

警告：mysqli_query()：第 34 行 C:\xampp\htdocs\project\save.php 中的空查询

拒绝离开。这是我的HTML：

<form method="post" action="http://localhost/project/save.php">
    <legend align="left">Login</legend>
    <input type="text" placeholder="Username" name="uname"><br>
    <input type="password" placeholder="Password" name="password"><br>
    <p>
        <label>
        <input type="radio" name="dbchoice" value="admin" id="RadioGroup1_0">
        Admin</label>
        <br>
        <label>
        <input type="radio" name="dbchoice" value="expert" id="RadioGroup1_1">Mental health experts</label>
        <br>
    </p>
    <input type="submit" value="Save" name="save">
    <input type="reset" value="Cancel">
</form>

这是我的PHP：

<?php

$hostname = "localhost";
$username = "root";
$password = "";
$db = "project";

//connect to the database using procedural method

$dbconnect = mysqli_connect($hostname,$username,$password,$db);

if(!$dbconnect){
    echo "an error occured while connecting to the database";
}

if(isset($_POST['save'])){
    //get values from the form
    $username = $_POST['uname'];
    $password = $_POST['password'];


    //write the SQL STATEMENT FOR SAVING - INSERT
    if (isset($dbchoice) && $dbchoice==$_POST["admin"]) {
        $sqlinsert = "INSERT INTO administrator 
                                    (username, password) 
                            VALUES('$username','$password')";
    }elseif (isset($dbchoice) && $dbchoice==$_POST["expert"]){
        $sqlinsert = "INSERT INTO experts
                                    (username, password) 
                            VALUES('$username','$password')";   
    }else{
        echo "An error occured while writing to database.";
    }
    if(mysqli_query($dbconnect,$sqlinsert)){
        echo "<script type='text/javascript'> alert('Data saved successfully');</script>";
        header('location: index.php');
    }else{
        echo "An error occured while saving";
    }

    //close the connection
    mysqli_close($dbconnect);

}else{
    header('location: index.php');
}
?>

标签： phpmysqlmysqli

解决方案

您错误地尝试将变量$dbchoice与不存在的 POST 字段进行比较$dbchoice==$_POST["admin"]- 该字段是dbchoice但值是admin

您需要测试这些字段是否存在于 POST 数组中，并且当且仅当它们存在时才将其分配为变量 - 也许这可能会有所帮助。另外-如果应该使用默认表，则将该单选按钮设置为selected可能？！

永远不要将未经处理的用户输入视为安全 - 不要像在此处那样在 SQL 语句中使用它，始终使用prepared statement带有正确绑定参数的 a。

<?php

error_reporting(E_ALL);

if (isset($_POST['save'], $_POST['uname'], $_POST['password'], $_POST['dbchoice'])) {
    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

    $hostname = "localhost";
    $username = "root";
    $password = "";
    $db = "project";
    $dbconnect = mysqli_connect($hostname, $username, $password, $db);

    $username = $_POST['uname'];
    $password = $_POST['password'];
    $dbchoice = $_POST['dbchoice'];

    switch ($dbchoice) {
        case 'admin':
            $sql = 'insert into `administrator` (`username`, `password`) values (?,?)';
        break;
        case 'expert':
            $sql = 'insert into `experts` (`username`, `password`) values( ?,? )';
        break;
        default:
            $sql = false;
        break;
    }
    
    if ($sql) {
        $stmt = $dbconnect->prepare($sql);
        $stmt->bind_param('ss', $username, $password);
        $stmt->execute();
        
        header('Location: index.php');
        exit;
    }
}

推荐阅读