problem with insert into mysql DB using PHP
I have strange problem that I have a PHP page use开发者_开发问答d to insert data into Mysql DB. the problem is that when I execute the code, nothing added to db and no errors is appeared although I set display errors codes
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('display_startup_errors', TRUE);
any idea about this problem !
here is my used code for inserting
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
if (PHP_VERSION < 6) {
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
}
$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}
include("Connections/mzk_mdc.php");
$ext = 1;
$website = "mzk";
$mzk_sql=sprintf("INSERT INTO downloads (image, `by`, `rapid_title`, title, `description`, category, div_id, topic_url, down_times, ext, `website`) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
GetSQLValueString($topic_thumb_image, "text"),
GetSQLValueString($topic_by, "text"),
GetSQLValueString($topic_des, "text"),
GetSQLValueString($topic_title, "text"),
GetSQLValueString($forum_content, "text"),
GetSQLValueString($topic_category, "text"),GetSQLValueString($topic_div, "text"),GetSQLValueString($forum_link, "text") ,GetSQLValueString($topic_down_times, "int"),GetSQLValueString($ext, "int"), GetSQLValueString($website, "text"));
mysql_select_db($database_mdc, $mdc);
$mzk_result = mysql_query($mzk_sql, $mdc) or die("can not do more");
mysql_close($mdc);
Have you tried using mysql_error() ?
i.e.
mysql_query('SHOW TABLES') or die(mysql_error());
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
This would insert a NULL if $theValue is 0 (zero). PHP type casts 0, "", '', null, and various other values as all being equal. Perhaps this is what you want, but I have a hard time seeing how turning a legitimate '0' into an SQL NULL is anything but a bad idea.
As well, in the defined
case, you're not escaping the $theDefinedValue
or $theUndefinedValue
, so those could still potentially lead to SQL injection, unless you're doing the escaping before the function call.
Have you put in some debug echoing in the code? Perhaps it's not even reaching your database operations because it's blowing up in that mzk_mdc.php file. At least have the code echo out the final query just before you do the query()
call and see if it's generating properly. Manually run it through the mysql monitor and see what happens.
First of all - simplify it:
if(''==$value)
$value = 'NULL'; //if you want that NULL in query
else
$value = function_exists('mysql_real_escape_string') ? mysql_real_escape_string($value) :mysql_escape_string($value); //It's enough to run that
Then try to print out mysql_error() and var_dump() both query and query result.
精彩评论