我尝试编写插入语句时出现PHP语法错误[重复]

This question already has an answer here:

这个问题在这里已有答案：

• PHP parse/syntax errors; and how to solve them? 13 answers
• PHP解析/语法错误;以及如何解决它们？ 13个答案

So I am having the $sql variable which is supposed to be a string containing an sql insert statement.Here's the piece of code:

所以我有$ sql变量，它应该是一个包含sql insert语句的字符串。这是一段代码：

$fields = array('Nume_dep' => $params['Nume_dep'],
                'Id_manager' => $params['Id_manager']);
$id = $params['Id_manager'];
$sql = "insert into departament(Nume_dep,Id_manager) values('$params['Nume_dep']', CONVERT($id, UNSIGNED))";

This is the error message that I get:

这是我得到的错误消息：

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING)

解析错误：语法错误，意外''（T_ENCAPSED_AND_WHITESPACE），期待标识符（T_STRING）或变量（T_VARIABLE）或数字（T_NUM_STRING）

The syntax error is in the insert statement, but I don't know how to fix it.

语法错误在insert语句中，但我不知道如何解决它。

2 个解决方案

#1

$id = $params['Id_manager'];
$nume_dep=$params['Nume_dep'];

$sql = "INSERT INTO departament(Nume_dep,Id_manager) values('$nume_dep', CONVERT($id, UNSIGNED))";

#2

In strings PHP will only do rather basic automatic variable expansion. The Issue is with the index operator here: $params['Nume_dep']

在字符串中，PHP只会进行基本的自动变量扩展。问题在于索引运算符：$ params ['Nume_dep']

Consider to use prepared statements in order to prevent SQL injection. If an attacker can make sure, that your function is called with something like "', 43); drop table department; --" as value for $params['Nume_dep'], you're going to be in big trouble.

考虑使用预准备语句以防止SQL注入。如果攻击者可以确定，你的函数被调用了类似“'，43）; drop table department; - ”作为$ params ['Nume_dep']的值，你就会遇到大麻烦。