PHP MySQL数据库问题

Question

<?php
class dbConnect {
  var $dbHost = 'localhost',
  $dbUser = 'root',
  $dbPass = '',
  $dbName = 'input_oop',
  $dbTable = 'users';
  function __construct() {


$dbc = mysql_connect($this->dbHost,$this->dbUser,$this->dbPass) or die ("Cannot connect to MySQL : " . mysql_error());
  mysql_select_db($this->dbName) or die ("Database not Found : " . mysql_error());
  }
  }
class User extends dbConnect {
  var $name;
  function userInput($q) {
 $sql = "INSERT INTO $this->dbTable set name = '".$q."'";
  mysql_query($sql) or die (mysql_error());
  }
}
?>

This is the code to call the class.

<?php
  $q = $_GET['q'];
$dbc=mysql_connect("localhost","root","") or die (mysql_error());
  mysql_select_db('input_oop') or die (mysql_error());
  $sql = "INSERT INTO users set name = '".$q."'";
  mysql_query($sql) or die (mysql_error());
?>

\n<?php \n  $q = $_GET['q']; \n$dbc=mysql_connect("localhost","root","") or die (mysql_error()); \n  mysql_select_db('input_oop') or die (mysql_error()); \n  $sql = "INSERT INTO users set name = '".$q."'"; \n  mysql_query($sql) or die (mysql_error()); \n?> \n

My save in my database:

Saving Multiple!

My save in my database:

Answer 1

Well, code 1 is open to SQL injection because you are not escaping $q. As to why you get two records, that problem is not to be found in code 1 but probably in the code that calls userInput .

Answer 2

它对所有SQL注入都是开放的，请尝试拥有db.php文件，并且在每个需要该数据库的php文件的开头都添加require_once。

Answer 3

Regarding SQL injection vulnerabilities, I'd suggest using prepared statements with PDO. It's easy to use and extremely secure.

More info: http://php.net/manual/en/pdo.prepared-statements.php