开发者

problem with insert into mysql DB using PHP

I have strange problem that I have a PHP page use开发者_开发问答d to insert data into Mysql DB. the problem is that when I execute the code, nothing added to db and no errors is appeared although I set display errors codes

error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('display_startup_errors', TRUE);

any idea about this problem !

here is my used code for inserting

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}


include("Connections/mzk_mdc.php");
                $ext = 1;
                $website = "mzk";
                $mzk_sql=sprintf("INSERT INTO downloads (image, `by`, `rapid_title`, title, `description`, category, div_id, topic_url, down_times, ext, `website`) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                    GetSQLValueString($topic_thumb_image, "text"),
                     GetSQLValueString($topic_by, "text"),
                       GetSQLValueString($topic_des, "text"),
                       GetSQLValueString($topic_title, "text"),
                     GetSQLValueString($forum_content, "text"),
                     GetSQLValueString($topic_category, "text"),GetSQLValueString($topic_div, "text"),GetSQLValueString($forum_link, "text") ,GetSQLValueString($topic_down_times, "int"),GetSQLValueString($ext, "int"), GetSQLValueString($website, "text"));
                       mysql_select_db($database_mdc, $mdc);
                       $mzk_result = mysql_query($mzk_sql, $mdc) or die("can not do more");

                       mysql_close($mdc);


Have you tried using mysql_error() ?

i.e.

mysql_query('SHOW TABLES') or die(mysql_error());


  $theValue = ($theValue != "") ? intval($theValue) : "NULL";

This would insert a NULL if $theValue is 0 (zero). PHP type casts 0, "", '', null, and various other values as all being equal. Perhaps this is what you want, but I have a hard time seeing how turning a legitimate '0' into an SQL NULL is anything but a bad idea.

As well, in the defined case, you're not escaping the $theDefinedValue or $theUndefinedValue, so those could still potentially lead to SQL injection, unless you're doing the escaping before the function call.

Have you put in some debug echoing in the code? Perhaps it's not even reaching your database operations because it's blowing up in that mzk_mdc.php file. At least have the code echo out the final query just before you do the query() call and see if it's generating properly. Manually run it through the mysql monitor and see what happens.


First of all - simplify it:

    if(''==$value) 
        $value = 'NULL'; //if you want that NULL in query
     else 
        $value = function_exists('mysql_real_escape_string') ? mysql_real_escape_string($value) :mysql_escape_string($value); //It's enough to run that

Then try to print out mysql_error() and var_dump() both query and query result.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜