插入两个日期之间使用数组

Question

$query = sprintf("INSERT INTO dat(empid,empname,reason,date)VALUES\n%s", 

implode(",\n", $values)) 

$query1= real_escape_string($query); 

请帮我对原代码。我不能插入字符。

Answer 1

首先，总是确保您的数据是安全的。

$emp_id_safe = filter_var($_POST['emp_id'], FILTER_SANITIZE_NUMBER_INT); 
    $emp_name_safe = filter_var($_POST['emp_name'], FILTER_SANITIZE_STRING); 
    $reason_safe = filter_var($_POST['reason'], FILTER_SANITIZE_STRING); 
    $end_date_safe = filter_var($_POST['to_date'], FILTER_SANITIZE_STRING); 

其次，MySQL的PHP​​扩展deprecated，并会在将来被移除。将其替换为mysqli。

 if ($emp_id_safe == FALSE || $emp_name_safe == FALSE || 
      $reason_safe == FALSE || $end_date_safe == FALSE) { 
      die('Filter failure'); 
     } else { 
      $stmt = $mysqli->prepare("INSERT INTO date(empid, empname, reason, date) VALUES (?, ?, ?, ?)"); 
      $stmt->bind_param("ssss", $emp_id_safe, $emp_name_safe, $reason_safe, $end_date_safe); 
      $stmt->execute(); 
     }