2017-03-08 55 views
0

错误:SQL的错误,我想在3表中插入数据,因为其他2桥

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')' at line 1

有什么更好的办法?

$insertSQL = sprintf("INSERT INTO booking (book_id,book_start_rent,book_end_rent,book_total,staff_id) VALUES (%s, %s, %s, %s, %s)", 
         GetSQLValueString($_POST['book_id'], "text"), 
         GetSQLValueString($_POST['book_start_rent'], "date"), 
         GetSQLValueString($_POST['book_end_rent'], "date"), 
         GetSQLValueString($_POST['book_total'], "double"), 
         GetSQLValueString($_POST["state2"], "text") 

         /"INSERT INTO car_booking (car_id, book_id) VALUES (%s, %s)", 
              GetSQLValueString($_POST['state'], "text"), 
              GetSQLValueString($_POST['book_id'], "text") 

          /"INSERT INTO member_booking (mem_id, book_id) VALUES (%s, %s)", 
           GetSQLValueString($colname_information2, "text"), 
           GetSQLValueString($_POST['book_id'], "text") 

          ); 

编辑:我试着把分号;在插入结束时,得到了一个错误syntax error, unexpected ';'

$insertSQL = sprintf("INSERT INTO booking (book_id,book_start_rent,book_end_rent,book_total,staff_id) VALUES (%s, %s, %s, %s, %s)", 
         GetSQLValueString($_POST['book_id'], "text"), 
         GetSQLValueString($_POST['book_start_rent'], "text"), 
         GetSQLValueString($_POST['book_end_rent'], "text"), 
         GetSQLValueString($_POST['book_total'], "double"), 
         GetSQLValueString($_POST["state2"], "text"); 

         "INSERT INTO car_booking (car_id, book_id) VALUES (%s, %s)", 
              GetSQLValueString($_POST['state'], "text"), 
              GetSQLValueString($_POST['book_id'], "text"); 

          "INSERT INTO member_booking (mem_id, book_id) VALUES (%s, %s)", 
           GetSQLValueString($colname_information2, "text"), 
           GetSQLValueString($_POST['book_id'], "text"); 

          ); 

编辑2:我终于可以插入,但有新的错误是

Cannot add or update a child row: a foreign key constraint fails (car rental booking . member_booking , CONSTRAINT FK__member FOREIGN KEY (mem_id) REFERENCES member (mem_id) ON DELETE CASCADE ON UPDATE CASCADE)

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form2")) { 
           $insertSQL = sprintf("INSERT INTO booking (book_id,book_start_rent,book_end_rent,book_total,staff_id) VALUES (%s, %s, %s, %s, %s)", 
                GetSQLValueString($_POST['book_id'], "text"), 
                GetSQLValueString($_POST['book_start_rent'], "text"), 
                GetSQLValueString($_POST['book_end_rent'], "text"), 
                GetSQLValueString($_POST['book_total'], "double"), 
                GetSQLValueString($_POST["state2"], "text")); 

       $insertSQL2 = sprintf("INSERT INTO car_booking (car_id, book_id) VALUES (%s, %s)", 
            GetSQLValueString($_POST['state'], "text"), 
            GetSQLValueString($_POST['book_id'], "text") ); 

            $insertSQL3 = sprintf("INSERT INTO member_booking (mem_id, book_id) VALUES (%s, %s)", 
             GetSQLValueString($colname_information2, "text"), 
             GetSQLValueString($_POST['book_id'], "text") ); 
+0

您在**生成的** SQL中有错误。首先看看。 –

+0

您可以在一个查询中执行单个插入(如果您不使用多查询env)。你必须执行3个分离的插入...错误只是你没有; (分号) – scaisEdge

+0

1)除非使用mysqli的multi_query,否则不能在同一个查询中执行全部3次插入操作。把它们分开。 2)您已经开放了SQL注入。确保您使用的是PDO或mysqli,并使用预准备语句和参数绑定。 – aynber

回答

0

您可以使用PDO:

// init PDO connection 
$db = new PDO('mysql:host=localhost;dbname=testdb;', 'username', 'password'); 
$sql1 = "INSERT INTO booking (book_id, book_start_rent, book_end_rent, book_total, staff_id) VALUES (:book_id, :book_start, :book_end_rent, :book_total, :staff_id)"; 
$prepared1 = $db->prepare($sql); 
$result1 = $prepared->execute(
    array(
     ':book_id' => GetSQLValueString($_POST['book_id'], "text"), 
     ':book_start' => GetSQLValueString($_POST['book_start_rent'], "date"), 
     ':book_end_rent' => GetSQLValueString($_POST['book_end_rent'], "date"), 
     ':book_total' => GetSQLValueString($_POST['book_total'], "double"), 
     ':staff_id' => GetSQLValueString($_POST["state2"], "text"), 
    ) 
); 
// and so on for each of your 3 queries 
+1

使用参数绑定时,不需要使用getSQLValueString。 – aynber

+0

如果你认为它所做的全部是sql注入,但是maby是更多的东西,我不知道函数中有什么 –

+0

这几乎就是它的全部功能。 http://stackoverflow.com/questions/4458180/php-getsqlvaluestring-function – aynber