Php mysqli插入语句问题

我的代码中出现以下错误：

绑定参数失败：（1064）您的SQL语法有错误；检查与您的MySQL服务器版本对应的手册，以了解使用接近“”的正确语法？（姓名、地址、位置、电话、电子邮件、时间、网站、照片1、评级、第1行的日期）

有人能帮我吗？这是我的密码：

include("mysqli.php");
$search_tbl = mysql_query("SELECT * from listing_title where listing_title_ID = '$main_id'");
$tbl_name = $search_tbl['tbl_name'];

                        $stmt = $db->stmt_init();
                        global $tbl_name;
                        if($stmt->prepare("INSERT INTO ? (Name, Address, Location, Phone, Email, Time, Website, Photo1, Rating, Date_Published, categories_ID) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) 
                        {
                                      $stmt->bind_param('sssssssssisi',$tbl_name,$title,$address,$location,$phone,$email,$time,$website,$name,$rating,$date,$sub_cat);
                $title = $_POST['name'];
                $email = $_POST['email'];
                $address = $_POST['address'];
                $location = $_POST['location'];
                $phone = $_POST['phone'];
                $time = $_POST['time'];
                $rating = $_POST['rating'];
                $main = $_POST['main'];
                $website = $_POST['website'];
                $date = date('Y-m-d');
                                    $stmt->execute();
                                    $stmt->close();

                            }
                            else
                            {
                              echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;

                            }


                    }
                    else
                    {

                    echo 'a';

                    }

---

你的脚本似乎不完整，但我尽我所能利用你所拥有的这就是你所需要的。首先，扔掉你正在使用的任何mysqli包装垃圾。这是在教你糟糕的原则

第一个文件是db info。可以叫它config.php或任何你想要的东西。使用require一次，而不是include。另外，去掉requires周围的括号。这些都不是必需的，使用单引号而不是双引号。单引号被视为字符串，而双引号php将搜索其中的变量，因此花费正在从cpu/缓存中删除更多资源

config.php

$host = 'localhost';//your db host
$user = 'someuser'; //your db user
$pass = 'somepass'; //your db password
$name = 'somedb'; //the name of your db
$mysqli = new mysqli($host,$user,$pass,$name);

if(mysqli_connect_errno()) { 
    echo "Connection Failed: " . mysqli_connect_errno(); 
    exit; 
}else{
    global $mysqli;//make your db connection available globally
}

require_once 'config.php';

//keep your post variables up here. you still need to santize and trim these
$title = $_POST['name'];
$email = $_POST['email'];
$address = $_POST['address'];
$location = $_POST['location'];
$phone = $_POST['phone'];
$time = $_POST['time'];
$rating = $_POST['rating'];
$main = $_POST['main'];
$website = $_POST['website'];
$date = date('Y-m-d');

global $mysqli;//fetch your db connection


$stmt = $mysqli->prepare("SELECT tbl_name from listing_title where listing_title_ID = ? ");
$stmt->bind_param('i',$main_id);
if($stmt->execute()) {
    $stmt->bind_result($tbl_name);
    $stmt->close();
    $stmt = $mysqli->prepare("INSERT INTO ".$tbl_name." 
    (Name, Address, Location, Phone, Email, Time, Website, Photo1, Rating, Date_Published, categories_ID) 
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);");
    $stmt->bind_param('ssssssssisi',$title,$address,$location,$phone,$email,$time,$website,$name,$rating,$date,$sub_cat);
    if($stmt->execute()) {
        $stmt->close();
    }else{
        $stmt->close();
        //catch the error
    }
}else{
    $stmt->close();
    //throw an exception or handle the error here.
}

function security($value) {
   if(is_array($value)) {
      $value = array_map('security', $value);
   } else {
      if(!get_magic_quotes_gpc()) {
         $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
      } else {
         $value = htmlspecialchars(stripslashes($value), ENT_QUOTES, 'UTF-8');
      }
      $value = str_replace("\\", "\\\\", $value);
   }
   return $value;
}

现在看你的剧本

script.php

$host = 'localhost';//your db host
$user = 'someuser'; //your db user
$pass = 'somepass'; //your db password
$name = 'somedb'; //the name of your db
$mysqli = new mysqli($host,$user,$pass,$name);

if(mysqli_connect_errno()) { 
    echo "Connection Failed: " . mysqli_connect_errno(); 
    exit; 
}else{
    global $mysqli;//make your db connection available globally
}

require_once 'config.php';

//keep your post variables up here. you still need to santize and trim these
$title = $_POST['name'];
$email = $_POST['email'];
$address = $_POST['address'];
$location = $_POST['location'];
$phone = $_POST['phone'];
$time = $_POST['time'];
$rating = $_POST['rating'];
$main = $_POST['main'];
$website = $_POST['website'];
$date = date('Y-m-d');

global $mysqli;//fetch your db connection


$stmt = $mysqli->prepare("SELECT tbl_name from listing_title where listing_title_ID = ? ");
$stmt->bind_param('i',$main_id);
if($stmt->execute()) {
    $stmt->bind_result($tbl_name);
    $stmt->close();
    $stmt = $mysqli->prepare("INSERT INTO ".$tbl_name." 
    (Name, Address, Location, Phone, Email, Time, Website, Photo1, Rating, Date_Published, categories_ID) 
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);");
    $stmt->bind_param('ssssssssisi',$title,$address,$location,$phone,$email,$time,$website,$name,$rating,$date,$sub_cat);
    if($stmt->execute()) {
        $stmt->close();
    }else{
        $stmt->close();
        //catch the error
    }
}else{
    $stmt->close();
    //throw an exception or handle the error here.
}

function security($value) {
   if(is_array($value)) {
      $value = array_map('security', $value);
   } else {
      if(!get_magic_quotes_gpc()) {
         $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
      } else {
         $value = htmlspecialchars(stripslashes($value), ENT_QUOTES, 'UTF-8');
      }
      $value = str_replace("\\", "\\\\", $value);
   }
   return $value;
}

请注意，这仍然需要工作。您需要清理和修剪变量。下面是一个示例函数。要包含funcs，只需在config.php文件中添加一次require_，它就会包含在包含config.php的任何文件中

例如：

require_once'funcs.php'；

消毒功能示例：

funcs.php

$host = 'localhost';//your db host
$user = 'someuser'; //your db user
$pass = 'somepass'; //your db password
$name = 'somedb'; //the name of your db
$mysqli = new mysqli($host,$user,$pass,$name);

if(mysqli_connect_errno()) { 
    echo "Connection Failed: " . mysqli_connect_errno(); 
    exit; 
}else{
    global $mysqli;//make your db connection available globally
}

require_once 'config.php';

//keep your post variables up here. you still need to santize and trim these
$title = $_POST['name'];
$email = $_POST['email'];
$address = $_POST['address'];
$location = $_POST['location'];
$phone = $_POST['phone'];
$time = $_POST['time'];
$rating = $_POST['rating'];
$main = $_POST['main'];
$website = $_POST['website'];
$date = date('Y-m-d');

global $mysqli;//fetch your db connection


$stmt = $mysqli->prepare("SELECT tbl_name from listing_title where listing_title_ID = ? ");
$stmt->bind_param('i',$main_id);
if($stmt->execute()) {
    $stmt->bind_result($tbl_name);
    $stmt->close();
    $stmt = $mysqli->prepare("INSERT INTO ".$tbl_name." 
    (Name, Address, Location, Phone, Email, Time, Website, Photo1, Rating, Date_Published, categories_ID) 
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);");
    $stmt->bind_param('ssssssssisi',$title,$address,$location,$phone,$email,$time,$website,$name,$rating,$date,$sub_cat);
    if($stmt->execute()) {
        $stmt->close();
    }else{
        $stmt->close();
        //catch the error
    }
}else{
    $stmt->close();
    //throw an exception or handle the error here.
}

function security($value) {
   if(is_array($value)) {
      $value = array_map('security', $value);
   } else {
      if(!get_magic_quotes_gpc()) {
         $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
      } else {
         $value = htmlspecialchars(stripslashes($value), ENT_QUOTES, 'UTF-8');
      }
      $value = str_replace("\\", "\\\\", $value);
   }
   return $value;
}

调用函数

$title=security（trim（$\u POST['name']）；

这是一个很有价值的练习，你有一个例子可以清理任何东西，无论是整数、数组、对象还是字符串

不过，您应该只对字符串使用修剪。如果要清理整个数组，只需使用安全功能

---

祝你好运。

这是你的第一个问题

mysql\u query

然后

bind\u param

-它们不会混合使用。只使用

mysqli.*

函数。另外，你要在“查询”之后声明你的POST变量。请正确缩进你的代码。另外，你不能将

插入？

表名不能“绑定”。我强烈建议您阅读有关准备好的语句的手册，包括阅读正确编写的教程。这里有一些教程要看：而且不要，我重复一遍，不要将

mysqli.*

函数与

mysql.*

混合使用，它们会在“你知道什么”中咬你一口。谢天谢地，有了这个注释框，否则我一定会修复这个代码。；-）