Question

这段代码工作正常，但我的问题是，当我使用php提交（大小）行数据这个PHP代码所以它是自动倍增并在phpmyadmin中提交，如350000

示例我提交表单和（大小）行数据是

480 x 800像素，4.3英寸（~217 ppi像素密度）传感器：加速度计，接近度

当我检查phpmyadmin（size）行时，它会自动相乘并提交（大小）行数据，如下所示

350000

我该如何解决这个问题，请帮我解决这个问题

感谢

这是php mysql表单数据提交代码

<?php
    /* 
     NEW.PHP
     Allows user to create a new entry in the database
    */

     // creates the new record form
     // since this form is used multiple times in this file, I have made it a function that is easily reusable
     function renderForm($model, $category, $weight,$size, $error)
     {
     ?>

     <?php 


     // if there are any errors, display them
     if ($error != '')
     {
     echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
     }
     ?> 

     <?php 
     }


     //This is the directory where images will be saved
    $target = "media/";
    $target = $target . basename( $_FILES['photo']['name']);

    //This gets all the other information from the form

    $photo=($_FILES['photo']['name']);
    //Writes the photo to the server
    if(move_uploaded_file($_FILES['photo']['tmp_name'], $target))
    {

    //Tells you if its all ok
    echo "<center>Photo ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory</center>";
    }


        //connect to database

         mysql_connect('localhost','root','password');
         mysql_select_db('price');



     // check if the form has been submitted. If it has, start to process the form and save it to the database
     if (isset($_POST['submit']))
     { 
     // get form data, making sure it is valid
     $model = mysql_real_escape_string(htmlspecialchars($_POST['model']));
     $category = mysql_real_escape_string(htmlspecialchars($_POST['category']));
     $weight = mysql_real_escape_string(htmlspecialchars($_POST['weight']));
     $size = mysql_real_escape_string(htmlspecialchars($_POST['size']));
     $entertainment = mysql_real_escape_string(htmlspecialchars($_POST['entertainment']));
     $price = mysql_real_escape_string(htmlspecialchars($_POST['price']));
     $date = mysql_real_escape_string(htmlspecialchars($_POST['date']));
     $photo = mysql_real_escape_string(htmlspecialchars($_FILES['photo']['name']));

     // check to make sure both fields are entered
     if ($model == '' || $category == '')
     {
     // generate error message
     $error = 'ERROR: Please fill in all required fields!';

     // if either field is blank, display the form again
     renderForm($model, $category, $weight, $size,$error);
     }
     else
     {
     // save the data to the database
      mysql_query("INSERT mprice SET model='$model', category='$category',  weight='$weight',  size='$size',  entertainment='$entertainment', price='$price', date='$date', photo='$photo'")
     or die(mysql_error()); 
     echo "<center>Done!</center>";
     // once saved, redirect back to the view page

     }
     }
     else
     // if the form hasn't been submitted, display the form
     {
     renderForm('','','','','','','','');
     }




    ?>

Answer 1

您正在体验SQL注入。也就是说，您允许用户提交的代码在数据库服务器中运行。字符串480 * 800是代码，MySQL服务器正在为您运行它。

这是不在开放互联网上的一个很酷的功能。幸运的是，你的一行中没有;DROP TABLE mprice;加速度计，是吗？

请考虑使用绑定变量。如果将MySQL API升级到mysqli_或PDO，这是最容易做到的。

如何在php mysql提交表单中停止自动乘法

1 个答案: