如何修复我的预订，因为当我发送它时。它没有在 mysql 上显示任何数据

Question

我正在设置我的预订 Web 应用程序并支持 UTF-8。我已经在运行 PHP 7 和 MySQL 以及 Apache 2。过去我尝试过做注册表单和登录表，当我做预订表时似乎最终发送回显“失败”。我正在使用面向对象的方法做 php这是我的bookingtest.php<?php$php_variable = 'string';// connectioninclude ('config.php');ob_start();  // if button register pressedif(isset($_POST['book'])){$fname = $_POST['fname'];$email = $_POST['email'];$phone = $_POST['phone'];$country = $_POST['country'];$swimming = $_POST['swimming'];$date = $_POST['date'];$numbercus= $_POST['numbercus'];$suits= $_POST['suits'];$certificate = $_POST['certificate'];$guide= $_POST['guide'];//inserting php form to mysql$sql_book = "INSERT INTO booking (fname, email, phone, country, swim, date, num, suits, cert, guide)VALUES ('$fname', '$email', '$phone', '$country', $swimming, '$date', '$numbercus', '$suits', '$certificate', '$guide')";//resultif ($result_book = $conn->query($sql_book)){    sleep(1);    echo "success";}else{    echo "Failed ! Please check your details !";}}?>

Answer 1

使用execute代替query和使用准备好的语句来处理 SQL INJECTION。

$sql = "INSERT INTO booking (fname, email, phone, country, swim, date, num, suits, cert, guide) VALUES (?,?,?,?,?,?,?,?,?,?)";

$stmt= $pdo->prepare($sql);

$stmt->execute([$fname, $email, $phone, $country, $swimming, $date, $numbercus, $suits, $certificate, $guide]);