0

現在PHPとMySQLを勉強中です。短いメッセージを送信し、サーバーからメッセージを取得できる単純なページを試みています (この特定のケースでは乱数のみ)。

<?php

$success = false;

require_once '../../../phpIncludes/mysqlIncludes.php';
require_once '../../../phpIncludes/iphandler.php';
$creds = new MySQLLoginCredentials;
$con = $creds->ConnectToDB();

mysql_select_db("testDB", $con);

$userMsg = trim($_POST['msg']);
//The simple version for 128 Characters from the beginning of the string
$userMsg = substr($userMsg,0,128);
$userMsg = filter_var($userMsg, FILTER_SANITIZE_STRING,!FILTER_FLAG_STRIP_LOW);

$ip = encode_ip( $_SERVER['REMOTE_ADDR'] );

$time = time();

$returnMsg = "". rand() . "";

$userAgent = mysql_real_escape_string($_SERVER['HTTP_USER_AGENT']);
//Trim to 256 since that is largest db can hold
$userAgent = substr($userAgent,0,256);
$userAgent = filter_var($userAgent, FILTER_SANITIZE_STRING);

//Debug 
echo "Time : " . $time . "<br>"
. " IP: " . $ip . " | " . decode_ip($ip) . "<br>"
. " UserAgent: " . $userAgent . "<br>"
. " Msg: " . $userMsg . "<br>"
. " Return: " . $returnMsg . "<br>";

$sql = "INSERT INTO TestMessageTbl (TimeStamp, IPAddress, ClientInfo, IncMsg, OutMsg)
VALUES ('" . $time . "', " . $ip . ", " . $userAgent . ", " . $userMsg . ", " . $returnMsg .")";

$success = mysql_query($sql, $con);

if($success == false)
{
    echo "Error: " . mysql_error();
}

echo $returnMsg;

mysql_close($con);
?>

出力は次のとおりです。

<i>Time : 1356919336
IP: * | *
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko)     Chrome/23.0.1271.97 Safari/537.11
Msg: 
Return: 743166102
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.' at line 2743166102</i>

テーブルは次のようになります。

UID bigint(20) unsigned, AUTO_INCREMENT
TimeStamp bigint(20) unsigned
IPAddress varchar(32) utf8_general_ci
ClientInfo varchar(256) utf8_general_ci
IncMsg varchar(128) utf8_general_ci
OutMsg varchar(128) utf8_general_ci

タイプミスがある場合に備えて、mysqlから手動で転記しました...

すぐに奇妙に感じたのは、エラーの行番号が非常に大きいことでした。どうしたの？

PS私は現状では知っています、$ msgは空白になります

4

1 に答える 1

2

すべての値を単純な引用符で囲む

$sql = "INSERT INTO TestMessageTbl (TimeStamp, IPAddress, ClientInfo, IncMsg, OutMsg)
VALUES ('" . $time . "', '" . $ip . "', '" . $userAgent . "', '" . $userMsg . "', '" . $returnMsg ."')";
于 2012-12-31T02:21:35.367 に答える