我是mysql和php的新手。一周前,这个代码工作得很好,现在我尝试时,它显示了这个错误消息
错误:您的sql语法有错误;查看与您的mariadb服务器版本相对应的手册,以获取正确的语法,使用near的产品组合已经多样化,以包含一个非常成功的多品牌产品
我花了一整天的时间在寻找如何解决这个问题,但还是想不出来。我在stackoverflow也试过类似的问题,但是我在这里被绊倒了。下面是我的代码
<?php
if(isset($_POST['upload']))
{ $company_name =$_POST['company_name'];
$service =$_POST['service'];
$email =$_POST['email'];
$password =$_POST['password'];
$details =$_POST['details'];
$fileName = $_FILES['Filename']['name'];
$fileName1 = $_FILES['Filename1']['name'];
$fileName2 = $_FILES['Filename2']['name'];
$fileName3 = $_FILES['Filename3']['name'];
$fileName4 = $_FILES['Filename4']['name'];
$target = "company_images/";
$fileTarget = $target.$fileName;
$fileTarget1 = $target.$fileName1;
$fileTarget2 = $target.$fileName2;
$fileTarget3 = $target.$fileName3;
$fileTarget4 = $target.$fileName4;
$tempFileName = $_FILES["Filename"]["tmp_name"];
$tempFileName1 = $_FILES["Filename1"]["tmp_name"];
$tempFileName2 = $_FILES["Filename2"]["tmp_name"];
$tempFileName3 = $_FILES["Filename3"]["tmp_name"];
$tempFileName4 = $_FILES["Filename4"]["tmp_name"];
$result = move_uploaded_file($tempFileName,$fileTarget);
$result1 = move_uploaded_file($tempFileName1,$fileTarget1);
$result2 = move_uploaded_file($tempFileName2,$fileTarget2);
$result3 = move_uploaded_file($tempFileName3,$fileTarget3);
$result4 = move_uploaded_file($tempFileName4,$fileTarget4);
$file = rand(1000,100000)."-".$_FILES['file']['name'];
$file_loc = $_FILES['file']['tmp_name'];
$file_size = $_FILES['file']['size'];
$file_type = $_FILES['file']['type'];
$folder="pdf_uploads/";
// new file size in KB
$new_size = $file_size/1024;
// new file size in KB
// make file name in lower case
$new_file_name = strtolower($file);
// make file name in lower case
$final_file=str_replace(' ','-',$new_file_name);//anthima
if(move_uploaded_file($file_loc,$folder.$final_file))
{
$query = "INSERT INTO company_details( company_name,service, email, password, details,image_path,file_name,image_path1,file_name1,image_path2,file_name2,image_path3,file_name3,file,type,size,image_path4,file_name4) VALUES ('$company_name','$service','$email','$password','$details','$fileTarget','$fileName','$fileTarget1','$fileName1','$fileTarget2','$fileName2','$fileTarget3','$fileName3','$final_file','$file_type','$new_size','$fileTarget4','$fileName4')";
$con->query($query) or die("Error : ".mysqli_error($con));
mysqli_close($con);
}
}
?>
<?php
下面给出的是测试数据错误
VALUES ('singer','Hardware','singer@gmail.com','singer','Singer has been in Sr' at line 1
1条答案
按热度按时间fcg9iug31#
因为你从不清理任何东西,直接把数据放到你的查询中,
你的问题很可能出在数据上
公司的产品组合已经多样化,包括一个非常成功的多品牌
也许你的数据中有不定形的撇号,所以你有点像sql注入你自己。查询在错误中显示的字符串之前结束。
解决方法是在插入前转义特殊字符,比如:如何只转义单引号?
在你的情况下,从细节开始
或者
但是继续为代码添加测试场景。e、 g.如果公司名称
Mc'Donaldson
? 每个字段要接受的字符集是什么?然后您将知道如何验证这些字段并创建函数(或重用某些内容)