問題描述

所以我正在修改腳本以包含準備好的語句.之前它運行良好，但現在我在腳本運行時收到沒有為準備好的語句中的參數提供數據".這里有什么問題?

So I am reworking a script to include prepared statements. It was working fine before, but now I am getting "No data supplied for parameters in prepared statement" when the script runs. What is the issue here?

<?php
require_once("models/config.php");


$firstname = htmlspecialchars(trim($_POST['firstname']));
$firstname = mysqli_real_escape_string($mysqli, $firstname);
$surname = htmlspecialchars(trim($_POST['surname']));
$surname = mysqli_real_escape_string($mysqli, $surname);
$address = htmlspecialchars(trim($_POST['address']));
$address = mysqli_real_escape_string($mysqli, $address);
$gender = htmlspecialchars(trim($_POST['gender']));
$gender = mysqli_real_escape_string($mysqli, $gender);
$city = htmlspecialchars(trim($_POST['city']));
$city = mysqli_real_escape_string($mysqli, $city);
$province = htmlspecialchars(trim($_POST['province']));
$province = mysqli_real_escape_string($mysqli, $province);
$phone = htmlspecialchars(trim($_POST['phone']));
$phone = mysqli_real_escape_string($mysqli, $phone);
$secondphone = htmlspecialchars(trim($_POST['secondphone']));
$secondphone = mysqli_real_escape_string($mysqli, $secondphone);
$postalcode = htmlspecialchars(trim($_POST['postalcode']));
$postalcode = mysqli_real_escape_string($mysqli, $postalcode);
$email = htmlspecialchars(trim($_POST['email']));
$email = mysqli_real_escape_string($mysqli, $email);
$organization = htmlspecialchars(trim($_POST['organization']));
$organization = mysqli_real_escape_string($mysqli, $organization);
$inriding = htmlspecialchars(trim($_POST['inriding']));
$inriding = mysqli_real_escape_string($mysqli, $inriding);
$ethnicity = htmlspecialchars(trim($_POST['ethnicity']));
$ethnicity = mysqli_real_escape_string($mysqli, $ethnicity);
$senior = htmlspecialchars(trim($_POST['senior']));
$senior = mysqli_real_escape_string($mysqli, $senior);
$student = htmlspecialchars(trim($_POST['student']));
$student = mysqli_real_escape_string($mysqli, $student);


$order= "INSERT INTO persons (firstname, surname, address, gender, city, province,  postalcode, phone, secondphone, email, organization, inriding, ethnicity, senior, student_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
$stmt = mysqli_prepare($mysqli, $order);
mysqli_stmt_bind_param($stmt, "sssd", $firstname, $surname, $address, $gender, $city, $province, $postalcode, $phone, $secondphone, $email, $organization, $inriding, $ethnicity, $senior, $student);
mysqli_stmt_execute($stmt); 
echo $stmt->error;

$result = mysqli_query($mysqli,$stmt);
if ($result === false) {
echo "Error entering data! <BR>";
echo mysqli_error($mysqli);
 } else {
echo "User $firstname added <BR>";
 }
?>

提前致謝.

推薦答案

你只綁定了四個參數，通過控制字符串sssd"，但是你有很多參數.用mysqli綁定變量時，每個參數需要一個字符，例如:

You have only bound four arguments, by the control string "sssd", but you have many parameters. When binding variables with mysqli, you need one character for each parameter, for example:

mysqli_stmt_bind_param($stmt, "sssdsssssssssdd", $firstname, $surname, $address, 
    $gender, $city, $province, $postalcode, $phone, $secondphone, $email, 
    $organization, $inriding, $ethnicity, $senior, $student);

(我假設senior 和student 是整數，并且需要d"代碼.)

(I'm assuming senior and student are integers, and need the "d" code.)

您不需要用 mysqli_real_escape_string() 處理任何變量——這就是使用參數的重點.如果您也進行轉義，則會在數據庫中的數據中得到文字反斜杠字符.

You don't need to treat any of your variables with mysqli_real_escape_string() -- that's the point of using parameters. If you do escaping as well, you'll get literal backslash characters in your data in the database.

而且在任何情況下都不需要使用 htmlspecialchars() - 在輸出到 HTML 時會使用它，而不是在插入到數據庫時使用.您將在數據庫中的數據中獲得諸如 & 之類的文字序列.

And you never need to use htmlspecialchars() in any case - you would use that when outputting to HTML, not when inserting to the database. You're going to get literal sequences like & in your data in the database.

下一個錯誤:

可捕獲的致命錯誤:mysqli_stmt 類的對象無法轉換為字符串..."

"Catchable fatal error: Object of class mysqli_stmt could not be converted to string in..."

這是由以下原因造成的:

This is caused by the following:

$result = mysqli_query($mysqli,$stmt);

該函數要求第二個參數是一個字符串，一個新的 SQL 查詢.但是您已經準備好該查詢，因此您需要以下內容:

That function expects the second argument to be a string, a new SQL query. But you've already prepared that query, so you need the following:

$result = mysqli_stmt_execute($stmt);

這篇關于“沒有為準備好的語句中的參數提供數據"的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！