PHP注册表格-SQL

Question

I want to make a Registration form from PHP to register their username and password into my SQL Database. 我想用PHP制作一个注册表单，以将其用户名和密码注册到我的SQL数据库中。 Here is what I have: 这是我所拥有的：

config.php: config.php：

   <?php
$host['naam'] = 'localhost';                // my host
$host['gebruikersnaam'] = 'root';       // my database username
$host['wachtwoord'] = '';   // my database password
$host['databasenaam'] = 'project';       // my database name

$db = mysql_connect($host['naam'], $host['gebruikersnaam'], $host['wachtwoord']) OR die ('Cant connect to the database');
mysql_select_db($host['databasenaam'], $db);
?>

index.php: index.php：

    <head>
    <title>Deltalus Account Registration</title>
    <style>
    *{ FONT-SIZE: 8pt; FONT-FAMILY: verdana; } b { FONT-WEIGHT: bold; } .listtitle { BACKGROUND: #425984; COLOR: #EEEEEE; white-space: nowrap; } td.list { BACKGROUND: #EEEEEE; white-space: nowrap; } </style>
    </head>
    <center><br><br><br><br>
    <h1>Deltalus Database</h1>
    <table cellspacing=1 cellpadding=5>
    <tr>
    <td class=listtitle colspan=2>Register at my server</td></tr>
    <form action="register_do.php" method="POST">
    <tr><td class=list align=right>Username:</td><td class=list><input type=text name=name maxlength="30"></td></tr>
    <tr><td class=list align=right>Password:</td><td class=list><input type=password name=pass maxlength="30"></td></tr>
    </td></tr>
    <tr><td class=listtitle align=right colspan=2><input type=submit name=submit value='Register'></td></tr>
    </form>
    </table>
    <br>

    </center></body></html

>

register_do.php: register_do.php：

   <?php
print '<title>Deltalus Database Server</title>';
$name = $_POST['name'];
$pass = $_POST['pass'];
include('config.php');
$sel = 'SELECT * FROM user WHERE username="'.$_POST['name'].'"';
if($name == ""){
echo 'No username filled in';
exit();
}elseif(mysql_num_rows(mysql_query($sel)) >= 1 ){
echo 'This username does already exists!';
exit();
}elseif($pass == ""){
echo 'No password filled in';
exit();
}else{
$d = 'INSERT INTO users (username, password) VALUES ("'.$name.'", "'.$pass.'")';
mysql_query($d) OR die (mysql_error());
echo 'Your account has been created, you can now login.';
}
?>

Ok so the problem is when I post this to my website. 好的，问题是当我将其发布到我的网站时。 It gives me this error saying that POST is not available or something. 它给我这个错误，说POST不可用或什么。 Wait let me back up, when I press register, it says that error. 等待，让我备份，当我按注册时，它表明该错误。 How would I fix this? 我该如何解决？ IS their anything wrong wtih my coding? 我的编码是否有误？

Thanks, 谢谢，

Kevin 凯文

Answer 1

Um... So many issues I don't know where to start. 嗯...这么多问题我都不知道从哪里开始。 First off, your code is SQL injection heaven. 首先，您的代码是SQL注入天堂。
You need to totally rethink this if this code is ever going to see the light of day. 如果此代码即将成为现实，则需要完全重新考虑这一点。

Consider what would happen if someone specified a username of: 考虑如果有人指定用户名：

blah","blah");DELETE TABLE users;

You didn't post your login code for this, but given your current coding style, consider if someone specified a password on login of: 您没有为此发布登录代码，但是鉴于您当前的编码风格，请考虑是否有人在登录时指定了密码：

asdf" OR "1" = "1

That would effectively log in any user without a password. 这将有效地登录任何没有密码的用户。

Also passwords should never be stored in plain text. 另外，密码绝对不能以纯文本形式存储。 They should at the very least be stored encrypted. 它们至少应加密存储。 In almost all cases they should be hashed. 在几乎所有情况下，都应将其散列。 That is to say they should be stored using one way encryption like SHA256. 也就是说，应该使用一种类似SHA256的加密方式来存储它们。 A recent discussion on this. 最近对此进行了讨论。

Then to check if the user provided a valid password, you compare the two hashed versions, and never know what the original was really. 然后，要检查用户是否提供了有效的密码，您可以比较两个哈希版本，而永远不知道原始密码是什么。

Consider using the mysqli library instead of mysql. 考虑使用mysqli库而不是mysql。 mysql in php is old and alot slower than mysqli. PHP中的mysql较旧并且比mysqli慢很多。 Mysqli also offers something called prepared queries that can eliminate the risk of SQL injection if used correctly. Mysqli还提供了一种称为“ 准备查询”的东西，如果使用得当，可以消除SQL注入的风险。 A class I've written to simplify it's use. 我编写的简化该类的使用。

Beyond these issues, it appears that you are not including config.php in your register_do.php. 除了这些问题，似乎您的register_do.php中没有包含config.php。 Your SQL statements will not work without it. 没有它，SQL语句将无法工作。

What version of php and mysql are you using? 您正在使用哪个版本的php和mysql？

Answer 2

It sounds like your HTTP server is misconfigured, and/or not accepting POST requests. 听起来您的HTTP服务器配置错误，和/或不接受POST请求。 Do you have this page on-line so that I can take a look and possibly elaborate? 您是否在线上有此页面，以便我查看一下并进行详细说明？

PHP注册表格-SQL

问题描述

2 个解决方案

解决方案1
6 2009-10-24 18:16:46

解决方案2
0 2009-10-24 18:04:50

PHP注册表格-SQL

问题描述

2 个解决方案

解决方案1 6 2009-10-24 18:16:46

解决方案2 0 2009-10-24 18:04:50

解决方案1
6 2009-10-24 18:16:46

解决方案2
0 2009-10-24 18:04:50