PHP验证提交

时间:2013-06-18 09:25:39

标签: php

我正在开发一个用户可以点击某个项目的项目。如果用户之前点击了它,那么当他再次尝试点击它时,它不应该在DB上工作或INSERT值。当我单击第一个项目(我正在通过id直接从数据库显示项目)时,它会插入到DB中,然后当我再次单击它时它工作(给我错误代码)不会插入到DB中。当我点击它们时所有其他项目,即使我点击第二次,第三次,第四次所有它都插入到数据库中。请帮帮我们感谢

<?php

session_start();
$date = date("Y-m-d H:i:s");

include("php/connect.php");

$query = "SELECT * FROM test ORDER BY `id` ASC LIMIT 3";
$result = mysql_query($query);

if (isset($_SESSION['username'])) {

    $username = $_SESSION['username'];

    $submit = mysql_real_escape_string($_POST["submit"]);

    $tests = $_POST["test"];

    // If the user submitted the form.
    // Do the updating on the database.
    if (!empty($submit)) {
        if (count($tests) > 0) {
            foreach ($tests as $test_id => $test_value) {
                $match = "SELECT user_id, match_id FROM match_select";
                $row1 = mysql_query($match)or die(mysql_error());
                while ($row2 = mysql_fetch_assoc($row1)) {
                    $user_match = $row2["user_id"];
                    $match = $row2['match_id'];
                }
                if ($match == $test_id) {
                    echo "You have already bet.";
                } else {
                    switch ($test_value) {
                        case 1:
                            mysql_query("UPDATE test SET win = win + 1 WHERE id = '$test_id'");
                            mysql_query("INSERT INTO match_select (user_id, match_id) VALUES ('1','$test_id')");
                        break;
                        case 'X':
                            mysql_query("UPDATE test SET draw = draw + 1 WHERE id = '$test_id'");
                            mysql_query("INSERT INTO match_select (user_id, match_id) VALUES ('1','$test_id')");
                        break;

                        case 2:
                            mysql_query("UPDATE test SET lose = lose + 1 WHERE id = '$test_id'");
                            mysql_query("INSERT INTO match_select (user_id, match_id) VALUES ('1','$test_id')"); 
                        break;
                        default:

                    }
                }
            }
        }
    }

    echo "<h2>Seria A</h2><hr/>
        <br/>Welcome,".$username."! <a href='php/logout.php'><b>LogOut</b></a><br/>";

    while ($row = mysql_fetch_array($result)) {

        $id = $row['id'];
        $home = $row['home'];
        $away = $row['away'];
        $win = $row['win'];
        $draw = $row['draw'];
        $lose = $row['lose'];

        echo "<br/>",$id,") " ,$home, " - ", $away;

        echo "
            <form action='seria.php' method='post'>
                <select name='test[$id]'>        
                    <option value=\"\">Parashiko</option>
                    <option value='1'>1</option>
                    <option value='X'>X</option>
                    <option value='2'>2</option>
                </select>
                <input type='submit' name='submit' value='Submit'/>
                <br/>
            </form>
            <br/>";        

        echo "Totali ", $sum = $win+$lose+$draw, "<br/><hr/>";
    }
} else {
  $error = "<div id='hello'>Duhet te besh Log In qe te vendosesh parashikime ndeshjesh<br/><a href='php/login.php'>Kycu Ketu</a></div>";
}

?>

3 个答案:

答案 0 :(得分:1)

你的问题在这里:

$match = "SELECT user_id, match_id FROM match_select";
$row1 = mysql_query($match)or die(mysql_error());
while ($row2 = mysql_fetch_assoc($row1)) {
    $user_match = $row2["user_id"];
    $match = $row2['match_id'];
}

您没有正确检查。您必须检查match_selectuser_id中的match_id条目是否存在。否则,$match将始终等于数据库中最后一个插入行的match_id字段:

$match = "SELECT * 
    FROM `match_select` 
    WHERE `user_id` = '<your_id>'
    AND `match_id` = '$test_id'";
$matchResult = mysql_query($match)or die(mysql_error());
if(mysql_num_rows($matchResult)) {
    echo "You have already bet.";
}

顺便说一句,考虑使用PDOmysqli来操纵数据库。不推荐使用mysql_个函数:

http://www.php.net/manual/fr/function.mysql-query.php

答案 1 :(得分:0)

如果数据已经存在,则通过查看表来验证记录的插入。

最简单的方法是

 $query = "SELECT * FROM match_select WHERE user_id = '$user_id'";
 $result = mysql_query($query);

 if(mysql_num_rows($result) > 0)
 {
   // do not insert
 }
 else
 {
   // do something here..
 } 

答案 2 :(得分:0)

在您的表单中,您有<select name='test[$id]'>(每个项目一个),然后当您提交表单时,您将获得$tests = $_POST["test"];您无需在表单中指定索引,只需执行<select name='test[]'>,您最终可以添加一个ID为<input type="hidden" value="$id"/>的隐藏字段。第二部分是目前不好的验证;您只需检查数据库中是否存在具有查询的迭代