为何HTML输入数据无法存入PHP Session变量？求MySQL入库方案

现有代码的核心问题 #

1. 表单标签错误：<form form method="post" 重复了form关键字，会导致表单提交行为异常
2. Session赋值逻辑错误：页面加载时就执行$_SESSION赋值，但此时用户未提交表单，$_POST变量为空，会触发未定义索引警告；且最后一行$_SESSION['name'] = $_POST['myContact'];错误覆盖了姓名字段，应改为$_SESSION['contact'] = $_POST['myContact'];
3. 缺少输入验证：未对必填项、输入格式（邮箱、日期、联系方式）做校验，容易导致无效数据入库
4. 安全风险：直接使用用户输入数据插入数据库，未做过滤或预处理，存在SQL注入风险
5. 逻辑冗余：将表单数据存入Session并非插入数据库的必要步骤，直接在处理页接收$_POST数据更高效

优化后的实现方案 #

1. 修正前端注册页面（register.php） #

<?php
session_start();
// 显示表单提交后的提示（如果有）
if(isset($_SESSION['message'])){
    echo "<p>{$_SESSION['message']}</p>";
    unset($_SESSION['message']);
}
?>
<html>
<head>
    <title> Blog space </title>
    <style>
        body { background-color: #EAEAEA; }
        .submit-btn { background-color:#46A5F9; color:white; width:19mm; border:none; padding:5px; cursor:pointer; }
        .error { color: red; font-size: 12px; }
    </style>
</head>
<body>
    <h4> Register </h4>
    <form method="post" action="InsertToDatabase.php">
        <fieldset>
            <legend style="color:#0080c0;font-weight:bold">Register</legend>
            <table> 
                <tr>
                    <td> Name: </td>
                    <td>
                        <input type="text" name="myName" required />
                        <?php if(isset($_SESSION['errors']['name'])) echo "<span class='error'>{$_SESSION['errors']['name']}</span>"; ?>
                    </td>
                </tr>
                <tr>                                
                    <td> Surname: </td>
                    <td> 
                        <input type="text" name="mySurname" required />
                        <?php if(isset($_SESSION['errors']['surname'])) echo "<span class='error'>{$_SESSION['errors']['surname']}</span>"; ?>
                    </td>
                </tr>
                <tr>
                    <td> Gender: </td>
                    <td>
                        <!-- 用单选框替代文本框，避免无效输入 -->
                        <input type="radio" name="myGender" value="male" required> Male
                        <input type="radio" name="myGender" value="female" required> Female
                        <input type="radio" name="myGender" value="other" required> Other
                        <?php if(isset($_SESSION['errors']['gender'])) echo "<span class='error'>{$_SESSION['errors']['gender']}</span>"; ?>
                    </td>
                </tr>
                <tr>
                    <td> Date of birth: </td>
                    <td> 
                        <input type="date" name="myDateOfBirth" required />
                        <?php if(isset($_SESSION['errors']['dob'])) echo "<span class='error'>{$_SESSION['errors']['dob']}</span>"; ?>
                    </td>
                </tr>
                <tr>
                    <td> Email: </td>
                    <td>
                        <input type="email" name="myEmail" required />
                        <?php if(isset($_SESSION['errors']['email'])) echo "<span class='error'>{$_SESSION['errors']['email']}</span>"; ?>
                    </td>
                </tr>
                <tr>    
                    <td> Contact: </td>
                    <td>
                        <input type="tel" name="myContact" required pattern="[0-9]{10,15}" placeholder="请输入10-15位数字">
                        <?php if(isset($_SESSION['errors']['contact'])) echo "<span class='error'>{$_SESSION['errors']['contact']}</span>"; ?>
                    </td>
                </tr>
            </table>
            <input class="submit-btn" type="submit" value="Submit"/>                                  
        </fieldset>                 
    </form>   
</body>
</html>
<?php
// 清除错误提示session
unset($_SESSION['errors']);
?>

2. 数据库处理页面（InsertToDatabase.php） #

<?php
session_start();
$errors = [];

// 验证表单数据
if(empty($_POST['myName'])) $errors['name'] = "姓名不能为空";
if(empty($_POST['mySurname'])) $errors['surname'] = "姓氏不能为空";
if(empty($_POST['myGender'])) $errors['gender'] = "请选择性别";
if(empty($_POST['myDateOfBirth'])) $errors['dob'] = "请选择出生日期";
if(!filter_var($_POST['myEmail'], FILTER_VALIDATE_EMAIL)) $errors['email'] = "邮箱格式无效";
if(empty($_POST['myContact']) || !preg_match("/^[0-9]{10,15}$/", $_POST['myContact'])) $errors['contact'] = "请输入10-15位有效联系方式";

// 如果有错误，跳转回注册页并提示
if(!empty($errors)){
    $_SESSION['errors'] = $errors;
    header("Location: register.php");
    exit;
}

// 连接数据库（使用PDO，更安全）
try {
    $pdo = new PDO('mysql:host=localhost;dbname=your_database_name;charset=utf8mb4', 'username', 'password');
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // 预处理SQL语句，防止SQL注入
    $stmt = $pdo->prepare("INSERT INTO users (name, surname, gender, date_of_birth, email, contact) VALUES (?, ?, ?, ?, ?, ?)");
    $stmt->execute([
        $_POST['myName'],
        $_POST['mySurname'],
        $_POST['myGender'],
        $_POST['myDateOfBirth'],
        $_POST['myEmail'],
        $_POST['myContact']
    ]);

    // 插入成功，提示用户
    $_SESSION['message'] = "注册成功！";
    header("Location: register.php");
    exit;
} catch(PDOException $e) {
    $_SESSION['message'] = "数据库错误：" . $e->getMessage();
    header("Location: register.php");
    exit;
}
?>

关键优化点说明 #

• 前端验证：使用HTML5的required属性、type="email"/type="tel"、pattern属性做基础校验，配合后端双重验证
• 安全防护：使用PDO预处理语句彻底避免SQL注入；对邮箱格式做正则校验
• 用户体验：添加错误提示和成功反馈，让用户清楚操作结果
• 逻辑简化：去掉不必要的Session存储，直接在处理页接收并处理表单数据，减少冗余
• 输入规范：将性别改为单选框，避免用户输入无效值；联系方式限制数字长度，保证数据一致性

内容的提问来源于stack exchange，提问作者no-one