前端Fetch POST与后端PHP $_POST的正确姿势

function insertNewRecord(data) {
    fetch('/configs/database/add.php', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded' // 关键的Content-Type
        },
        body: `name=${data.name}&contact=${data.contact}&delivery=${data.delivery}&value=${data.value}` // 数据在请求体中
    })
    .then(function(response) {
        if (response.ok) {
            return response.text();
        }
        throw new Error('Error in the request.');
    });
    // ... 后续DOM操作
}

<?php 
    // ... 获取URL相关信息
    $CurPageURL = $protocol . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];  
    $parts = parse_url($CurPageURL);

    if(count($parts) <= 3) return;

    parse_str($parts['query'], $query); // 错误：从URL查询字符串中解析数据

    // ... 后续数据库操作使用 $query['param']
?>

<?php 
// 引入数据库连接函数
require_once 'db_config.php'; // 假设你有一个db_config.php文件用于数据库连接

// 检查请求方法是否为POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405); // Method Not Allowed
    echo json_encode(['error' => 'Only POST requests are allowed.']);
    exit();
}

// 检查并获取POST数据
// 始终对用户输入进行验证和清理
$name = isset($_POST['name']) ? trim($_POST['name']) : '';
$contact = isset($_POST['contact']) ? trim($_POST['contact']) : '';
$delivery = isset($_POST['delivery']) ? trim($_POST['delivery']) : '';
$value = isset($_POST['value']) ? floatval($_POST['value']) : 0.0; // 假设value是浮点数

// 简单的输入验证
if (empty($name) || empty($contact) || empty($delivery) || $value <= 0) {
    http_response_code(400); // Bad Request
    echo json_encode(['error' => 'Invalid or missing data.']);
    exit();
}

try {
    $conn = OpenCon(); // 假设OpenCon()返回一个PDO或mysqli连接对象

    // 使用预处理语句防止SQL注入
    $sql = "INSERT INTO users (name, contact, delivery, value) VALUES (?, ?, ?, ?)";

    // 假设使用PDO
    $stmt = $conn->prepare($sql);
    $stmt->execute([$name, $contact, $delivery, $value]);

    // 假设使用mysqli
    // $stmt = $conn->prepare($sql);
    // $stmt->bind_param("sssd", $name, $contact, $delivery, $value); // sssd表示string, string, string, double
    // $stmt->execute();

    if ($stmt->affected_rows > 0 || $stmt->rowCount() > 0) { // 根据数据库驱动判断
        http_response_code(201); // Created
        echo json_encode(['message' => 'Record inserted successfully.']);
    } else {
        http_response_code(500); // Internal Server Error
        echo json_encode(['error' => 'Failed to insert record.']);
    }

    $stmt->close();
    CloseCon($conn); // 假设CloseCon()关闭数据库连接

} catch (Exception $e) {
    http_response_code(500); // Internal Server Error
    echo json_encode(['error' => 'Database error: ' . $e->getMessage()]);
    // 生产环境中不应直接暴露错误信息，应记录到日志
}

?>

<?php
function OpenCon() {
    $dbhost = "localhost";
    $dbuser = "your_username";
    $dbpass = "your_password";
    $db = "your_database";
    $charset = 'utf8mb4';

    $dsn = "mysql:host=$dbhost;dbname=$db;charset=$charset";
    $options = [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES   => false,
    ];
    try {
        $pdo = new PDO($dsn, $dbuser, $dbpass, $options);
        return $pdo;
    } catch (\PDOException $e) {
        throw new \PDOException($e->getMessage(), (int)$e->getCode());
    }
}

function CloseCon($conn) {
    $conn = null; // PDO连接通过设置null来关闭
}
?>