PHP与MySQL数据库连接及表单数据处理问题求助

Hey there, let's walk through the potential issues in your PHP-MySQL code and work through fixes step by step:

First off, your line $phoneNumber = $... is cut off—this will immediately throw a PHP syntax error because the parser can't understand incomplete code. Make sure to finish assigning this variable properly, matching the name attribute from your HTML form. For example:

$phoneNumber = isset($_POST['phonenumber']) ? trim($_POST['phonenumber']) : '';

You're directly accessing $_POST variables without verifying two critical things:

• That the request actually came from a POST submission (so users can't trigger errors by loading the page directly)
• That each required form field exists and has a value

Add a check for the request method and use isset() or filter_input() to safely retrieve values:

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Safely get form data, trim whitespace, and default to empty string if missing
    $firstName = isset($_POST['firstname']) ? trim($_POST['firstname']) : '';
    $lastName = isset($_POST['lastname']) ? trim($_POST['lastname']) : '';
    $streetAddress = isset($_POST['streetaddress']) ? trim($_POST['streetaddress']) : '';
    $phoneNumber = isset($_POST['phonenumber']) ? trim($_POST['phonenumber']) : '';
} else {
    // Handle non-POST requests (e.g., show the form)
    echo "Please submit the form to proceed.";
}

If you plan to insert this data into your database directly (without sanitization), you're opening yourself up to SQL injection attacks—this is a critical security flaw. Always use prepared statements with parameter binding to avoid this:

// Example: Insert data into a 'users' table
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // ... (get form data as above)

    // Prepare the SQL statement with placeholders
    $stmt = mysqli_prepare($dbConnection, "INSERT INTO users (first_name, last_name, street_address, phone_number) VALUES (?, ?, ?, ?)");
    
    // Bind variables to the placeholders (the "ssss" means 4 string values)
    mysqli_stmt_bind_param($stmt, "ssss", $firstName, $lastName, $streetAddress, $phoneNumber);
    
    // Execute the statement and check for success
    if (mysqli_stmt_execute($stmt)) {
        echo "User data saved successfully!";
    } else {
        echo "Error saving data: " . mysqli_stmt_error($stmt);
    }
    
    // Clean up
    mysqli_stmt_close($stmt);
}

You're mixing constants (dbServer, dbName) and variables ($dbUsername, $dbPassword) for database credentials. While this works, following a consistent convention makes your code easier to read. A common PHP practice is to use uppercase constants for configuration values:

define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', '1');

$dbConnection = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);

Your connection error handling is good, but don't stop there—add error checking for all database operations (like inserts, updates, or queries) to catch issues early, as shown in the prepared statement example above.

内容的提问来源于stack exchange，提问作者razr_unlimited