PHP数据库插入报语法错误（new.php第61行），求解决方案

核心错误点 #

1. PHP字符串定义错误：你用反引号（``）包裹了SQL语句，这在PHP中是执行系统命令的语法，并非定义字符串的方式，必须改用单引号或双引号。
2. MySQL保留字冲突：check是MySQL的保留关键字，作为表名使用时必须用反引号（`）包裹才能被正确解析。
3. SQL字符串引号冲突：SQL中字符串值建议用单引号包裹，避免与PHP的双引号解析逻辑产生冲突。

修复后的基础版本代码 #

<?php

$servername = "localhost";
$username = "root";
$password = "";
$database =  "routine maker";

$conn = mysqli_connect($servername, $username, $password, $database);

if(!$conn){
    die("Sorry we failed to connect: ". mysqli_connect_error());
}else{
    echo '<script>alert("Connection was successful");</script>';
}

// 修正：用单引号定义SQL，表名check加反引号，字段值用单引号
$sql = 'INSERT INTO `check` (teacherName, subject, class) VALUES (\'skg\', \'Doe\', 4)';
if ($conn->query($sql) === TRUE) {
  echo "New record created successfully";
} else {
  echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();
?>

安全优化方案（防SQL注入） #

直接拼接SQL存在注入风险，推荐使用预处理语句：

<?php

$servername = "localhost";
$username = "root";
$password = "";
$database =  "routine maker";

$conn = mysqli_connect($servername, $username, $password, $database);

if(!$conn){
    die("Sorry we failed to connect: ". mysqli_connect_error());
}else{
    echo '<script>alert("Connection was successful");</script>';
}

// 预处理SQL语句，用占位符代替具体值
$stmt = $conn->prepare("INSERT INTO `check` (teacherName, subject, class) VALUES (?, ?, ?)");
// 绑定参数："ssi"表示三个参数分别是字符串、字符串、整数
$stmt->bind_param("ssi", $teacherName, $subject, $class);

// 给参数赋值
$teacherName = "skg";
$subject = "Doe";
$class = 4;

// 执行语句
if ($stmt->execute()) {
  echo "New record created successfully";
} else {
  echo "Error: " . $stmt->error;
}

// 关闭资源
$stmt->close();
$conn->close();
?>

内容的提问来源于stack exchange，提问作者Lokesh Singh