使用mysqli预处理语句时，CURRENT_DATE的查询绑定标记是什么？

Question

因此，我已经完成了一个问答网站的构建，现在正试图防御SQL注入，但是CURRENT_DATE有问题。我想将当前的日期与问题插入到数据库中，但是绑定标记是什么？ “s”字符串不工作？

<?php 
$servername = "localhost"; 
$username = "root"; 
$password = ""; 
$dbname = "questions87"; 

// Create connection 
$conn = new mysqli($servername, $username, $password, $dbname); 

// Check connection 
if ($conn->connect_error) { 
    die("Connection failed: " . $conn->connect_error); 
} 
session_start(); 
$question = $_POST["question"]; 


$uname = $_SESSION['username']; 

$qa_email =$_SESSION['email']; 

// prepare and bind 
$stmt = $conn->prepare("INSERT INTO login (username, username, q_date, qa_email) VALUES (?, ?, ?, ?)"); 
$stmt->bind_param("ssss", $question, $uname, CURRENT_DATE, $qa_email); 



$stmt->execute(); 

if ($stmt) {echo "Thank you ". $uname . " Your question has been submitted " . "<br>";} 
else {echo "Error: " . $sql . "<br>" . mysqli_error($conn);} 


$stmt->close(); 
$conn->close(); 
?> 

Answer 1

使用简单的MySQL函数NOW()和删除占位符q_date：

$stmt = $conn->prepare("INSERT INTO login (username, username, q_date, qa_email) VALUES (?, ?, NOW(), ?)"); 
$stmt->bind_param("sss", $question, $uname, $qa_email); 

顺便说一句，我注意到，你在这个查询字段username两次。我想其中一个出现应该被其他领域所取代。