堆栈内存溢出
  简体   繁体   English

php mysql注册表格

[英]php mysql register form

 原文  2017-09-09 03:50:08  9   1    php/ html/ mysql

问题描述

I've tried creating a register php code so i can sign people up when im not at my computer but for some reason it wont create the table and wont create the folders even when there not there. 我已经尝试创建一个注册php代码，这样我可以在即时消息不在我的计算机上时注册人们，但是由于某种原因，即使不在那儿，它也不会创建表，也不会创建文件夹。

the output is: 输出为：

( ! ) Notice: Undefined variable: db_add_user （！）注意：未定义变量：db_add_user

added user 添加的用户

user folder already created 用户文件夹已创建

user image folder already created 用户图像文件夹已创建

user profile picture already there 用户个人资料图片已经在那里

didn't create user table 没有创建用户表

done DONE

and here's the code 这是代码

connection.php connection.php 

<?php

$servername = "localhost";
$username = "root";
$password = "";

// Create connections
$main_db = new mysqli($servername, $username, $password, "main_db");
$user_db = new mysqli($servername, $username, $password, "u");
$chat_db = new mysqli($servername, $username, $password, "chat");
$log_db = new mysqli($servername, $username, $password, "log");

?>

index.php 的index.php 

<?php
require('/website/live/includes/checkadmin.php')
?>

<html>
    <head>
        <title>register</title>
        <link rel="stylesheet" type="text/css" href="/main.css">
    </head>
    <body class="disableNotifications">
        <?php include("/website/live/includes/nav.php"); ?>

        <form action="register.php" method="post" >
            <input type="text" name="user" placeholder="user" required>
            <input type="text" name="login" placeholder="login" required>
            <input type="text" name="pass" placeholder="pass" required>
            <input type="text" name="email" placeholder="" required>
            <input type="text" name="year" placeholder="" required>
            <button type="submit"><h2>register</h2></button>
            <button type="reset"><h2>reset</h2></button>

        </form>

    </body>
</html>

register.php register.php 

<?php
#makes sure user is admin
require("/website/live/includes/checkadmin.php");
#opens connection to database
require("/website/live/includes/connection.php");

$query = $main_db->query("SELECT user FROM main_table WHERE user = '$_POST[user]'", MYSQLI_USE_RESULT);

if ($query) {
   while ($row = $query->fetch_array()) {
       $db_add_user = $row['user'];
   }
}

if ($db_add_user != $_POST['user']) {

    #adds user to main database
    $inserttable = "INSERT INTO `main_table` (`ID`, `user`, `email`, `year`, `login`, `pass`, `admin`, `master`, `banned`) VALUES (NULL, '$_POST[user]', '$_POST[email]','$_POST[year]' ,'$_POST[login]', '$_POST[pass]', 'False', 'False', 'False')";

    if ($main_db->query($inserttable, MYSQLI_USE_RESULT) === TRUE) {
        echo "added user <br>";
    } 
    else {
        echo "didn't add user <br>";
    }

    #makes folders
    if (file_exists("'/website/live/u/' . $_POST[user]") === TRUE) {
        mkdir('/website/live/u/' . $_POST['user']);
        echo "created user folder <br>";
    }
    else {
        echo "user folder already created <br>";
    }
    if (file_exists("'/website/live/u/' . $_POST[user] . '/images'") === TRUE) {
        mkdir('/website/live/u/' . $_POST['user'] . '/images');
        echo "created user image folder <br>";
    }
    else {
        echo "user image folder already created <br>";
    }
    if (file_exists("'/website/live/images/logo.png','/website/live/u/'.$_POST[user].'/logo.png'") === TRUE) {
        copy('/website/live/images/logo.png','/website/live/u/'.$_POST['user'].'/logo.png');
        echo "copyed user logo across <br>";
    }
    else {
        echo "user profile picture already there <br>";
    }
    #adds folders to user database
    $makeimages = "CREATE TABLE `$_POST[user]` ('name' TEXT NOT NULL , `time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP , `upvotes` INT NOT NULL DEFAULT '0' , `downvotes` INT NOT NULL DEFAULT '0' , UNIQUE `name` (`name`))";

    if ($user_db->query($makeimages, MYSQLI_USE_RESULT) === TRUE) {
        echo "created user table <br>";
    }
    else {
        echo "didn't create user table <br>";
    }

}

else {
    echo "user already added <br>";
    die;
}

#not going to redirect so erros can be displayed
echo "done <br>";
?>

btw the email input is just a number cause reasons. 顺便说一句，电子邮件输入仅仅是一些原因。

1 个解决方案

解决方案1
 1 已采纳  2017-09-09 04:01:50

I imagine due to the undefined variable your query is failing: 我想由于未定义的变量，您的查询失败了：

Notice: Undefined variable: db_add_user 注意：未定义的变量：db_add_user 

$query = $main_db->query("SELECT user FROM main_table WHERE user = '$_POST[user]'", MYSQLI_USE_RESULT);

if ($query) {
   while ($row = $query->fetch_array()) {
       $db_add_user = $row['user'];
   }
}

If query is false ( or return no results ) the while never runs, ergo the variable is never set. 如果query为false（或不返回任何结果），而while从不运行，则永远不会设置该变量。 One thing that is at least "bad form" is this 至少是“不良形式”的一件事是这样的 

  '$_POST[user]'"

No quotes for the key, this should issue a warning like undefined constant, then PHP will default the constant value to = the name of the constant, or name . 键没有引号，这将发出警告，例如未定义的常量，然后PHP将默认的常量值=常量的名称或name 。

It's doubtful that is why it is failing, but one never knows. 令人怀疑的是，它为什么会失败，但没人知道。 In any case the while loop itself here is pointless when a single result is expected. 无论如何，当期望单个结果时，while循环本身毫无意义。 Especially when using fetch_array instead of just fetch . 特别是在使用fetch_array而不是仅fetch 。 That said I haven't used Mysqli in about 4 years so I'm a bit rusty on that as I use PDO these days. 那就是说我已经有4年没有使用过Mysqli了，所以我最近在使用PDO时对此感到有些生锈。 But unless I am mistaken, fetch_array should return the whole result set, thereby also making the while loop pointless. 但是除非我弄错了，否则fetch_array应该返回整个结果集，从而也使while循环毫无意义。

In the case that the query does run, your user may not be correct. 如果查询确实在运行，则您的用户可能不正确。

Note - this is not necessary intended as an answer but is too much for a comment. 注意-不一定要作为答案，但对于评论来说太多了。

Following through with this, ignoring the fact it's totally open to SQL injection, when concatenating $_POST values directly into the SQL, is that you should check that the value of that post item is indeed what it should be. 接着，忽略将$_POST值直接连接到SQL中时完全可以进行SQL注入的事实是，您应该检查该发布项目的值确实是应该的。 If not then it all falls apart. 如果没有，那一切都会崩溃。 ie $_POST['user'] is what you think it is. 即$_POST['user']是您认为的。

Also, another thing on the while loop. 另外，while循环上还有另一件事。

By working my way through your code. 通过我的代码遍历。 fetch_array returns something like this fetch_array返回类似这样的内容 

 [
   0 => ['item' => 'value' ]
 ]

In other words a multidimensional array. 换句话说，是多维数组。 So therefore your while loop as it's coded can never pull the correct $row['user'] value out, because row is the entire result set, wrapped in a container array. 因此，由于编码时，while循环永远无法提取正确的$row['user']值，因为row是整个结果集，包装在容器数组中。 So you would be looking at one level up in the array then where you think you are. 因此，您将在阵列中上一层，然后在您认为的位置上看。 ie. 即。 an array of rows, not a single row. 行数组，而不是单行。

As mentioned in the comments by @Javad, your file_exists check in the if statement is also incorrect. 如@Javad的注释中所述，您的file_exists检查if语句也是不正确的。 

 file_exists("'/website/live/u/' . $_POST[user]");

Containing both single and double quotes ( also missing quotes around the key ). 同时包含单引号和双引号（也缺少键周围的引号）。 And should be of the form such as 并且应采用以下形式： 

 file_exists('/website/live/u/' . $_POST['user']);


 file_exists("/website/live/u/{$_POST['user']}");  //I prefer the {} for variable interpolation, yep that's a big word that means variable interpretation, or more simply PHP will just fill the variable value in.

etc. 等等

Really, just think what that first error means to your code, in your mind replace this $db_add_user with ? 真的，只要考虑一下第一个错误对您的代码意味着什么，就可以将$db_add_user替换$db_add_user ? or undefined . 或undefined 。 As it runs it will pass into the loop because surely that is not equal to posted user value. 在运行时，它将进入循环，因为肯定不等于发布的用户值。 And with the improper formatted file exists check, the file will never exist, which causes it to create the proper file, because those are coded correctly. 而且，如果检查格式不正确的文件是否存在，该文件将永远不存在，这将导致它创建正确的文件，因为这些文件的编码正确。 So the next time you run it, it does the same thing, creating the proper files/folders, which don't match the miss coded file exists check. 因此，下次运行它时，它会执行相同的操作，创建与未编码文件不匹配的正确文件/文件夹，请检查。

This Line is extremely troubling ( which is why i took the time to explain the below ): 这条线非常麻烦（这就是为什么我花时间解释以下内容）： 

  $inserttable = "INSERT INTO `main_table` (`ID`, `user`, `email`, `year`, `login`, `pass`, `admin`, `master`, `banned`) VALUES (NULL, '$_POST[user]', '$_POST[email]','$_POST[year]' ,'$_POST[login]', '$_POST[pass]', 'False', 'False', 'False')";

Imagine I post this as my password. 想象一下，我将其作为密码发布。 

$_POST[pass] = "password', true, true, false )--";

The -- comments the rest of the sql out, so I just made myself an admin, and master of your site. --将其余的sql注释掉，所以我只是将自己设为管理员和站点的管理员。 ( assuming you mean true and not 'true' as a string ) Because your query becomes something like this （假设您的意思是true而不是'true'作为字符串）因为查询变成这样 

"INSERT INTO `main_table` (`ID`, `user`, `email`, `year`, `login`, `pass`, `admin`, `master`, `banned`) VALUES (NULL, 'god', 'gad@heaven.com','2017' ,'God', 'password', true, true, false) --', 'False', 'False', 'False')"

Where nothing after the -- counts because the DB thinks its a comment. 在--不重要的部分是因为DB认为它是注释。 Now I am not saying that exactly would work, as I'm not in a habit of exploiting SQL injection vulnerabilities, but it's close enough that you should seriously consider using prepared statements. 现在，我并不是说这完全可行，因为我没有养成利用SQL注入漏洞的习惯，但是它足够接近，您应该认真考虑使用准备好的语句。

暂无
暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 PHP向MySQL注册表格 - Php register form with mysql 用php，mysql注册表单 - Register form with php, mysql Android通过PHP和MySQL注册表格 - Android Register Form with PHP and MySQL php mysql使用注册表格插入mysql - php mysql INSERT INTO mysql by using register form PHP的MySQL阿贾克斯注册表格与图像上传 - php mysql ajax register form with image upload php + mysql + ajax和jquery以注册形式 - php + mysql + ajax and jquery in register form 使用php和mysql在注册表单上检索电子邮件地址很困难 - Difficulty on retrieving email address on a register form with php and mysql 注册表格PHP SQL - Register form PHP SQL PHP表格：注册用户 - Php form: register users 注册表格PHP - Register form PHP
相关标签
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM