php数据访问增删查

<form action="chuli.php" method="post">
    <div>用户名：<input type="text" name="uid" /></div>
    <div>密码：<input type="text" name="pwd" /></div>
    <div><input type="submit" name="" value="确定" /></div>
</form>

$uid = $_POST["uid"];
$pwd = $_POST["pwd"];


$db = new MySQLi("localhost","root","159357","shuiguo");

$sql = "select password from login where username=‘{$uid}‘";  //当用此方法时会出现不输入数据就能直接登录，所以要加if判断密码不等于空

$reslut = $db->query($sql);

$n = $reslut->fetch_row();

if($uid !="" && $pwd != "")          //判断用户名跟密码不等于空
{
    if($n[0]==$pwd)                    //当用此方法时会出现不输入数据就能直接登录，所以要加if判断密码不等于空
    {
        header("location:main.php");
    }
    else
    {
        echo "用户名或密码错误！";
    }
}
else
{
    echo "用户名密码不能为空";
}

<table width="100%" border="1" cellpadding="0" cellspacing="0">
    <tr>
        <td>代号</td>
        <td>姓名</td>
        <td>性别</td>
        <td>民族</td>
        <td>生日</td>
        <td>操作</td>
    </tr>

<?php
$db = new MySQLi("localhost","root","159357","renyuanxinxi");

$sql = "select * from info";

$result = $db->query($sql);

$attr = $result->fetch_all();

foreach($attr as $v)
{
    $sex = $v[2]?"男":"女";                //三维运算符
    
    $name = NationName($v[3]);
    /*$sname = "select name from nation where code=‘{$v[3]}‘";        //根据民族代号查询民族名称
    
    $rname = $db->query($sname);        //执行返回rname结果集
    
    $aname = $rname->fetch_row();*/        //返回数组aname 里面存民族名称  查到了一个
    
    echo "<tr>";
    echo "<td>{$v[0]}</td>
          <td>{$v[1]}</td>
          <td>{$sex}</td>
          <td>{$name}</td>
          <td>{$v[4]}</td>
          <td><a href=‘shanchu.php?c={$v[0]}‘ onclick=\"return confirm(‘主人真的不要我了吗？‘)\">删除</a></td>";        
//传主键值c，根据主键值删除数据
　//confirm 带确定的对话框（如果用户点确定就返回true  点取消就返回false）  //   \反斜杠 转义字符
                                          //第一种方法：直接写<td>
    /*foreach($v as $v1)                //第二种方法：用循环代替<td>
    {
        echo "<td>{$v1}</td>";
    }
    echo "</tr>";*/
}

function NationName($code)                //如果觉得上面写的比较乱，可以用封装  //给一个民族代号返回民族名称
{
    $db = new MySQLi("localhost","root","159357","renyuanxinxi");

    $sql = "select name from nation where code=‘{$code}‘";
    
    $result = $db->query($sql);
    
    $attr = $result->fetch_row();
    
    return $attr[0];
}
?>

</table>

<a href="add.php"><input type="button" value="点我添加" /></a>

<?php

$code = $_GET["c"];

$db = new MySQLi("localhost","root","159357","renyuanxinxi");

$sql = "delete from info where code=‘{$code}‘";

$r = $db->query($sql);

if($r)
{
    header("location:main.php");
}
else
{
    echo "删除失败！";
}

<form action="addchuli.php" method="post">
    <div>代号：<input type="text" name="code" /></div>
    <div>姓名：<input type="text" name="name" /></div>
    <div>性别：
    <input type="radio" name="sex" value="1" checked="checked" />男
    &nbsp;
    <input type="radio" name="sex" value="0" />女
    </div>
    <div>民族：
    <select name="nation">
        <?php
        $db = new MySQLi("localhost","root","159357","renyuanxinxi");
        $sql = "select * from nation";                    //查找民族信息
        $result = $db->query($sql);
        $result = fetch_all();
        
        foreach($attr as $v)
        {
            echo "<option value=‘{$v[0]}‘>{$v[1]}</option>";                //所有表单提交的是value值
        }
        ?>
    </select>
    </div>
    <div>生日：<input type="text" name="birthday" /></div>
    
    <div><input type="submit" value="添加"</div>
</form>

$code = $_POST["code"];
$name = $_POST["name"];
$sex = $_POST["sex"];
$nation = $_POST["nation"];
$birthday = $_POST["birthday"];

$db = new MySQLi("localhost","root","159357","renyuanxinxi");

$sql = "insert into info values(‘{$code}‘,‘{$name}‘,{$sex},‘{$nation}‘,‘{$birthday}‘)";        //‘{$name}‘字符串往布尔型里面扔永远是true

$db->query($sql);

header("location:main.php");        //在添加性别与民族的时候要写 1或者0  民族代号

sql语句代码   

    $sql = "select count(*) from login where username=‘{$uid}‘ and password=‘{$pwd}‘"

用特定字符串登录   a‘ or ‘1‘=‘1

解决方法
针对php来说：
1、优化语句    
2、处理用户输入内容，用函数判断有无特殊符号   
3、PDO方法：分两次发送