PHP查询结果到新数据库

Question

The code bellow is used to find a client by entering that client's specific username and password. 下面的代码用于通过输入客户端的特定用户名和密码来查找客户端。 But i want to save the result from any query to specific table called orders. 但是我想将任何查询的结果保存到称为订单的特定表中。 The problem is that i have trouble with coding that. 问题是我在编码时遇到了麻烦。 Here is my code and in the loop which the comment "//save the queried results to new database" is, i want to insert the code for the variables which then will be inserted to the table. 这是我的代码，在注释“ //将查询结果保存到新数据库”的循环中，我想为变量插入代码，然后将其插入表中。

<?php
    mysql_connect("localhost", "hidden", "hidden") or die("Error connecting to database: ".mysql_error());
    mysql_select_db("users") or die(mysql_error());

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title>Search results</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <link rel="stylesheet" type="text/css" href="style.css"/>
</head>
<body>
<?php
    $query = $_GET['query']; 
    $password = $_GET['password'];

    $min_length = 3;

    if(strlen($query) >= $min_length){ // if query length is more or equal minimum length then

        $query = htmlspecialchars($query); 
        // changes characters used in html to their equivalents, for example: < to &gt;

        $query = mysql_real_escape_string($query);
        // makes sure nobody uses SQL injection

        $raw_results = mysql_query("SELECT * FROM users
            WHERE (`username` LIKE '%".$query."%') AND (`password` LIKE '%".$password."%')") or die(mysql_error());



        if(mysql_num_rows($raw_results) > 0){ // if one or more rows are returned do following

            while($results = mysql_fetch_array($raw_results)){

                //save the queried results to new database
            }

        }
        else{
            echo "Nema rezultati za takov korisnik";
        }

    }
    else{ // if query length is less than minimum
        echo "Minimalnata dolzina na stringot e: ".$min_length;
    }
?>
</body>
</html>

Answer 1

You code has a lot of security issues. 您的代码有很多安全问题。

First, you should not pass parameters like username and password as GET parameters. 首先，您不应将用户名和密码之类的参数作为GET参数传递。 The browser might save the url in history, a user might share the link to twitter. 浏览器可能会将URL保存在历史记录中，用户可能会共享指向Twitter的链接。 Not safe, pass parameters with POST. 不安全，请通过POST传递参数。

Second, applying mysql_real_escape_string() to username will not protect you from an SQL injection , (see this SQL injection that gets around mysql_real_escape_string() ). 其次，将mysql_real_escape_string（）应用于用户名不会保护您免受SQL注入的侵害 （请参阅绕过mysql_real_escape_string（）的SQL注入）。 Use prepared statements please . 请使用准备好的陈述 。 You should not use htmlspecialchars() , you are not echoing the username to the page. 您不应该使用htmlspecialchars() ，也不要在页面上回显用户名。 Moreover, you should search the database with the html special characters but not with their html values. 此外，您应该使用html特殊字符而不是其html值搜索数据库。

eg, if username = "<username>", search the database with "<username>" and not with "&lt ;username&gt ;". 例如，如果username =“ <username>”，则使用“ <username>”而不是“＆lt; username＆gt;”搜索数据库。 You should only apply htmlspecialchars when you echo the username to the page, eg echo 'Hello '.htmlspecialchars($username).', how are you?'; 您只应在将用户名回显到页面时应用htmlspecialchars ，例如echo 'Hello '.htmlspecialchars($username).', how are you?';

Third, you use mysql_*, you shouldn't. 第三，您不应该使用mysql_ *。 mysql_* is deprecated in PHP 5.5.0 and removed in PHP 7. Use mysqli_* instead. mysql_ *在PHP 5.5.0中已弃用 ，在PHP 7中已删除 。请改用mysqli_ *。

Fourth, you should never, query the database with password LIKE %$passwordFromuser% . 第四，永远不要使用password LIKE %$passwordFromuser%查询数据库。 Imagine you have the password of "hellomypassword" and the username of "Bob". 假设您有密码“ hellomypassword”和用户名“ Bob”。 So I login with the credentials: username = "Bob" password = "a", so the expression "%a%" matches "hellomypassword". 因此，我使用凭据登录：username =“ Bob” password =“ a”，因此表达式“％a％”与“ hellomypassword”匹配。 So i have accessed your account. 因此，我已经访问了您的帐户。 Same with username, applying '%' to the username is wrong. 与用户名相同，将'％'应用于用户名是错误的。

Last but not least, use a strong hashing algorithm for storing the passwords to the database. 最后但并非最不重要的一点是， 使用强大的哈希算法将密码存储到数据库。

Now, the first query should return only one single row (only one row should have a specific set of username and password) so you do not need the while($results = mysql_fetch_array($raw_results)){} . 现在，第一个查询应该仅返回一行（只有一行应具有一组特定的用户名和密码），因此您不需要while($results = mysql_fetch_array($raw_results)){} 。 Just fetch the results once. 只需获取一次结果。

Then use the results and perform an INSERT query to the table like the following INSERT INTO tbName (rowName1,rowName2) VALUES (rowValue1, rowValue2) . 然后使用结果并像下面的INSERT INTO tbName (rowName1,rowName2) VALUES (rowValue1, rowValue2)一样对表执行INSERT查询。

PHP查询结果到新数据库

问题描述

1 个解决方案

解决方案1
2 2016-02-10 21:38:55

PHP查询结果到新数据库

问题描述

1 个解决方案

解决方案1 2 2016-02-10 21:38:55

解决方案1
2 2016-02-10 21:38:55