使用Node.js和Handlebars插入MySQL记录时遇表单提交问题

Hey Eric, let's work through the issues you're hitting when trying to submit your user form data to MySQL. I notice your form snippet is incomplete, so first let's get that sorted, then dive into the backend logic where most insertion problems crop up.

First, let's complete and harden your form—missing elements like a submit button or proper method/action attributes are common gotchas:

<form id="userForm" method="POST" action="insert-user.php">
  <fieldset>
    <legend>Add User</legend>
    <p>First Name: <input id="fname" type="text" name="fname" required></p>
    <p>Last Name: <input id="lname" type="text" name="lname" required></p>
    <p>Email: <input id="email" type="email" name="email" required></p>
    <p><button type="submit">Add User</button></p>
  </fieldset>
</form>

Quick notes on the changes:

• Added method="POST" (always use POST for sensitive data—GET exposes inputs in the URL)
• Added action to point to your backend script (replace insert-user.php with your actual file name)
• Swapped the email input type to email for built-in browser validation
• Added required to ensure users can't submit empty fields
• Added a submit button (you were missing this in your original snippet!)

Most insertion failures come from insecure or buggy backend code. Here's a safe, working PHP example using prepared statements—never use raw SQL with user input (it's a massive security risk):

<?php
// Your database connection details
$host = 'localhost';
$dbname = 'your_database_name';
$username = 'your_db_user';
$password = 'your_db_password';

try {
    // Set up a PDO connection (more flexible than MySQLi)
    $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $username, $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // Only run if the form was submitted via POST
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        // Clean up user input
        $fname = trim($_POST['fname']);
        $lname = trim($_POST['lname']);
        $email = trim($_POST['email']);

        // Prepare the SQL statement (separates data from logic to block injection)
        $stmt = $pdo->prepare("INSERT INTO users (first_name, last_name, email) VALUES (:fname, :lname, :email)");
        
        // Bind the form data to the statement
        $stmt->bindParam(':fname', $fname);
        $stmt->bindParam(':lname', $lname);
        $stmt->bindParam(':email', $email);

        // Execute and check success
        if ($stmt->execute()) {
            echo "User added successfully!";
        } else {
            echo "Oops, something went wrong adding the user.";
        }
    }
} catch(PDOException $e) {
    // Catch and display database errors (great for debugging)
    die("Database error: " . $e->getMessage());
}
?>

Key things to check here:

• Prepared Statements: This is non-negotiable. It stops attackers from injecting malicious SQL into your database.
• Table Column Names: Make sure your users table has columns named first_name, last_name, and email—if your columns use different names (like fname instead of first_name), adjust the INSERT query to match.
• Credentials: Double-check your host, username, password, and database name—incorrect credentials are one of the most common fixes.

If you're still stuck, run through these checks:

• Database Permissions: Ensure your database user has INSERT permissions on the users table.
• AJAX Issues (if using JS): If you're submitting the form with JavaScript, make sure you're preventing the default form submission and sending data correctly. Here's a quick vanilla JS example:

document.getElementById('userForm').addEventListener('submit', function(e) {
    e.preventDefault(); // Stop the default form reload

    const formData = new FormData(this);

    fetch('insert-user.php', {
        method: 'POST',
        body: formData
    })
    .then(response => response.text())
    .then(data => {
        alert(data); // Show the backend's message
        this.reset(); // Clear the form
    })
    .catch(error => console.error('Error:', error));
});

• Error Logs: Check your server's error logs (usually in /var/log/apache2/ or similar) for more detailed error messages if the frontend doesn't show you enough.

内容的提问来源于stack exchange，提问作者Eric Walters