如何通過循環將字符串轉換爲變量並將其保存在MySQL數據庫中

Question

我有這個問題。這是我的PHP代碼採取一個MySQL表以及將數據插入到另一個MySQL表：

<?php 
$connect = mysql_connect("host","user","password"); 
    if (!$connect){ 
     die("Failed to connect to the database: ".mysql_error()); 
    } 
$kies_bd = mysql_select_db("eraenz_db1",$connect); 
    if (!$kies_bd){ 
     die("failed to choose from BD: ".mysql_error()); 
    } 
$query = "SELECT ListNumber FROM residential"; 
$result1 = mysql_query($query); 
    if (mysql_num_rows($result1) >10){ 
     $difference = mysql_num_rows($result1) - 10; 
     $myQuery = "SELECT * FROM residential ORDER BY id LIMIT 10, $difference"; 
     $result2 = mysql_query($myQuery); 

    while ($line = mysql_fetch_array($result2)){ 
     mysql_query("INSERT INTO lisitngs 
     (listnumber, mandatetype, listdate,expirydate, updatedate,virtualtoururl,status,propertyright,agnt_id, erfsize,erf_no, housesize,outbuildingsize, bathroomoptions,closedusergroup,facingoptions,features,kitchenoptions,flatlet,parking,carport,price,numofbath,numofbed, numofgarages, numofkitchens, numofreception,numofstudies,numofdomesticbath,numofdomesticbed,numofoutsidetoil,off_id,ownershiptype, parkingdesc, pooloptions,pool,sellingreason,sfeatureoptions,roofoptions,roomoptions,walloptions,windowoptions, styleoptions,securityoptions,tempcontrol,streetname,streetnumber, suburb, propertycategory,propertytype,ss_name,agentcontactname,province,city, postalcode,email,listingstatus,feedtype, rates, levies) 
     values ({$line['ListNumber']}','{$line['MandateType']}','{$line['ListDate']}','{$line['ExpiryDate']}','{$line['UpdateDate']}','{$line['VisualTourURL']}','{$line['Status']}','{$line['PropertyCategory']}','{$line['AgentI']}','{$line['SizeOfErf']}','{$line['StandNumber']}','{$line['SizeOfHouse']}','{$line['SizeOfOutBuildings']}','{$line['BathroomOptions']}','{$line['ClosedUserGroup']}','{$line['FacingDescrip']}','{$line['Features']}','{$line['KitchenOptions']}','{$line['Flatlet']}','{$line['Parking']}','{$line['NumOfCarports']}','{$line['ListPrice']}','{$line['NumOfBathrooms']}','{$line['NumOfBedrooms']}','{$line['NumOfGarages']}','{$line['NumOfKitchens']}','{$line['NumReceptionRooms']}','{$line['NumStudies']}','{$line['NumOfDomBathrooms']}','{$line['NumOfDomBedrooms']}','{$line['NumOfOutSideToilets']}','{$line['OfficeId']}','{$line['OwnershipType']}','{$line['ParkingDesc']}','{$line['PoolOptions']}','{$line['Pool']}','{$line['ReasonForSelling']}','{$line['SpecialFeatures']}','{$line['RoofOptions']}','{$line['RoomOptions']}','{$line['WallFinishes']}','{$line['Windows']}','{$line['StyleOptions']}','{$line['SecurityOptions']}','{$line['TempControl']}','{$line['StreetName']}','{$line['StreetNumber']}','{$line['Suburb']}','{$line['PropertyCategory']}','{$line['TypeOfProperty']}','{$line['UnitName']}','{$line['AgentContactName']}','{$line['Province']}','{$line['City']}','{$line['PostalCode']}','{$line['SellerEmail']}','{$line['Status']}','{$line['FeedType']}','{$line['MunRatesTaxes']}','{$line['MonthlyLevy']}')"); 
     mysql_query("INSERT INTO clients 
       (clnt_title,clnt_name,clnt_surname,clnt_street_name,clnt_street_no,clnt_complex_name,clnt_unit_no,clnt_suburb,clnt_city,clnt_cell,clnt_email,agnt_id,) 
     values ({$line['SellerTitle']}','{$line['SellerFirstName']}','{$line['SellerSurname']}','{$line['StreetName']}','{$line['StreetNumber']}','{$line['UnitName']}','{$line['UnitNumber']}','{$line['Suburb']}','{$line['City']}','{$line['SellerMobileNumber']}','{$line['SellerEmail']}','{$line['AgentID']}')"); 
     mysql_query("DELETE FROM residential WHERE ListNumber={$line['ListNumber']}"); 
     echo "{$line['ListNumber']} was deleted <br/>"; 
    } 
} 
mysql_close($connect); 

?> 

現在不是所有的列是與在它應該被插入到自己的櫃檯部分列兼容。

我給你的問題是，如何將這些不兼容的字符串保存到變量中，然後將它們插入到數據庫表中？

Answer 1

使用Prepared Statements。 PHP會自動爲你轉換類型，並且你可以防止注入攻擊。

實際上，你應該在代碼中的任何地方使用Prepared Statements ...從字符串構建SQL是一個壞習慣。