使用HTML表单、$_POST及$_SERVER['REQUEST_METHOD']向MySQL插入数据的特殊需求

Got it, let's break this down step by step for your specific scenario. I'll walk you through each part with practical code examples that align exactly with what you need:

First, we'll build a simple HTML form that sends data via the POST method. You can leave the action blank to submit to the same PHP file, or specify another file path if needed:

<form method="POST" action="">
  <label for="username">用户名:</label>
  <input type="text" id="username" name="username" required>
  
  <label for="email">邮箱:</label>
  <input type="email" id="email" name="email" required>
  
  <button type="submit">提交</button>
</form>

Next, we'll set up your database credentials and establish a connection using MySQLi (PDO works too, but MySQLi is straightforward for this use case). We'll add basic error handling to catch connection issues early:

// 数据库配置信息
$host = 'localhost';
$dbname = 'your_database_name';
$db_user = 'your_db_username';
$db_pass = 'your_db_password';

// 建立数据库连接
$conn = mysqli_connect($host, $db_user, $db_pass, $dbname);

// 检查连接是否成功
if (!$conn) {
  die("数据库连接失败: " . mysqli_connect_error());
}

Now, we'll declare your variables and initialize them to NULL first (this avoids undefined variable warnings when the page loads without a POST request). Then, we'll wrap the $_POST value retrieval inside an if statement that checks if the request is actually a POST request:

// 初始化变量为NULL
$username = NULL;
$email = NULL;

// 仅在POST请求时处理数据
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  // 从POST中获取值（这里可以添加额外的过滤/验证逻辑）
  $username = mysqli_real_escape_string($conn, $_POST['username']);
  $email = mysqli_real_escape_string($conn, $_POST['email']);
  
  // 这里可以添加插入数据库的核心逻辑，比如：
  $sql = "INSERT INTO users (username, email) VALUES ('$username', '$email')";
  
  if (mysqli_query($conn, $sql)) {
    echo "数据插入成功!";
  } else {
    echo "插入失败: " . mysqli_error($conn);
  }
}

// 关闭数据库连接
mysqli_close($conn);

关键提醒 #

For production environments, always use prepared statements instead of manual escaping — the example above uses mysqli_real_escape_string for simplicity, but prepared statements are the safest way to prevent SQL injection. Here's a quick snippet of how that would look for the insert:

// 在POST语句块内替换为预处理语句
$stmt = $conn->prepare("INSERT INTO users (username, email) VALUES (?, ?)");
$stmt->bind_param("ss", $username, $email);

$username = $_POST['username'];
$email = $_POST['email'];
$stmt->execute();

echo "新记录创建成功";
$stmt->close();

内容的提问来源于stack exchange，提问作者inSee