登录后如何将含登录用户user_id的活动数据存入MySQL数据库

我制作了创建活动页面，但提交的数据无法存入数据库。使用PHPMyAdmin插入数据时，尽管已建立users和event_details两张表的关联，仍需填写user_id字段。尝试通过Session中存储的username获取登录用户的user_id时，出现语法错误：

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting '-' or identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in C:\wamp64\www\assignment\addevent.php on line 5

相关代码 #

表单处理代码 #

<?php
require "config.php";
include("auth.php");

    if(isset($_POST['submit'])) {
        $event_name=$_POST["event_name"];
        $event_description=$_POST["event_description"];
        $video_url=$_POST["video_url"];
        $image_url=$_POST["image_url"];
        $start_date=$_POST["start_date"];
        $end_date=$_POST["end_date"];
        $start_time=$_POST["start_time"];
        $end_time=$_POST["end_time"];
        $sql_query="INSERT INTO event_details ( event_name, event_description , video_url, image_url, start_date, end_date, start_time, end_time) values('$event_name','$event_description','$video_url','$image_url','$start_date','$end_date','$start_time','$end_time')";

        if(mysqli_query($con,$sql_query)) {
            header("Location: adminevents.php");
        }
        
    }   
?>

登录代码 #

<?php
// Calling the Connection file!
require "config.php";

session_start();
// If form submitted, insert values into the database.

if (isset($_POST['username'])){
    $username = stripslashes($_REQUEST['username']);
    $username = mysqli_real_escape_string($con,$username);
    $password = stripslashes($_REQUEST['password']);
    $password = mysqli_real_escape_string($con,$password);
    
    //Checking is user existing in the database or not
    $query = "SELECT * FROM users WHERE username='$username' and password='$password'";
    $result = mysqli_query($con,$query);
    $rows = mysqli_num_rows($result);
    
    if($rows==1){
    $_SESSION['username'] = $username;
    
    
    // Redirect user to a welcome page
    header("Location: welcome.php");
    }
    else {
        echo "<div class='wrongpass' style='color:red; font-size:12px; margin-left: 3px;'><h3>Username or password is incorrect.</h3> </div> <br/>";
    }
} ?>

数据库连接代码 #

<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */

$db_name="sistdb";
$mysql_user="root";
$mysql_pass="";
$server_name="localhost";

$con=mysqli_connect($server_name,$mysql_user,$mysql_pass,$db_name);

if(!$con) {
    echo "Connection Error ..." .mysql_connect_error();
} ?>

Session验证代码 #

<?php
session_start();
if(!isset($_SESSION["username"])){
    header("Location: login.php");
    exit(); 
} ?>

出错的尝试代码 #

<?php
require "config.php";
include("auth.php");
    $query  "SELECT user_id FROM `users` WHERE username = $_SESSION['username']";
    $result = mysqli_query($con,$query);
    $row=mysqli_fetch_assoc($result) 
    $userid = $row["user_id"];


    if(isset($_POST['submit'])) {
        $event_name=$_POST["event_name"];
        $event_description=$_POST["event_description"];
        $video_url=$_POST["video_url"];
        $image_url=$_POST["image_url"];
        $start_date=$_POST["start_date"];
        $end_date=$_POST["end_date"];
        $start_time=$_POST["start_time"];
        $end_time=$_POST["end_time"];
        $sql_query="INSERT INTO event_details ( event_name, event_description , video_url, image_url, start_date, end_date, start_time, end_time) values('$event_name','$event_description','$video_url','$image_url','$start_date','$end_date','$start_time','$end_time')";

        if(mysqli_query($con,$sql_query)) {
            header("Location: adminevents.php");
        }
        
    }   
?>

注：此网站为学校作业项目。

1. 修复语法错误（Parse Error的根源） #

出错代码存在3处语法问题：

• 变量赋值缺少=：$query "SELECT ..."需改为$query = "SELECT ..."
• 双引号字符串中使用带引号的数组元素：需用{}包裹$_SESSION['username']，或先赋值给变量
• 语句末尾缺少分号：$row=mysqli_fetch_assoc($result)需添加;

修正后的查询代码（二选一即可）：

// 方法1：用{}包裹数组元素
$query = "SELECT user_id FROM `users` WHERE username = '{$_SESSION['username']}'";

// 方法2：先将Session值赋值给变量
$username = $_SESSION['username'];
$query = "SELECT user_id FROM `users` WHERE username = '$username'";
// 补充分号
$row = mysqli_fetch_assoc($result);

2. 解决数据无法存入数据库的问题 #

因为event_details表要求user_id字段，插入语句必须包含该字段：

// 先获取正确的user_id（修正后的代码）
$username = $_SESSION['username'];
$query = "SELECT user_id FROM `users` WHERE username = '$username'";
$result = mysqli_query($con,$query);
$row = mysqli_fetch_assoc($result);
$userid = $row["user_id"];

// 修改插入语句，添加user_id字段
$sql_query="INSERT INTO event_details (user_id, event_name, event_description , video_url, image_url, start_date, end_date, start_time, end_time) 
VALUES('$userid','$event_name','$event_description','$video_url','$image_url','$start_date','$end_date','$start_time','$end_time')";

3. 额外建议（作业项目也可优化） #

• 避免SQL注入：使用mysqli预处理语句替代直接拼接变量到SQL中
• 密码安全：不要明文存储密码，登录时用password_hash()加密、password_verify()验证

内容的提问来源于stack exchange，提问作者Note