Question

我正在尝试将数据保存到sql db中的注册表单。我还没有进行表单验证，因为最令我不安的是将这些东西放到sql上。我很感激任何建议!!

我有一个form.php文件，应该做的很辛苦。当我提交表单时，此时，我得到一个空白屏幕，没有任何内容加载到数据库中。

<?php
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$password = $_POST['password'];
$email = $_POST['email'];
$cell = $_POST['cell'];
$experience = $_POST['experience'];
$ip = $_POST['ip'];

$password = md5($_POST['password']);

$connection = msql_connect(localhost, USERNAME, PASSWORD);
$db = mysql_select_db(registration,$connection);    

mysql_query("INSERT INTO userTable (fname,lname,password,email,cell,experience,ip) VALUES ('$fname', '$lname', '$password', '$email', '$cell', '$experience', '$ip')")
    or die (mysql_error());

echo "Thank you for your registration";


?>

我有一个包含这个的html文件：

            <form method = "post" action = "form.php">
            <h2>User Information</h2>

            <div><label>First Name:</label>
                <input type = "text" name = "fname"></div>
            <div><label>Last Name:</label>
                <input type = "text" name = "lname"></div>
            <div><label>Password:</label>
                <input type = "password" name = "password"></div>
            <div><label>Email:</label>
                <input type="text" name="email"></div>
            <div><label>Cellphone:</label>
                <input type="text" name="cell"></div>
                <input type="hidden" name="ip" value='<?php echo $IP ?>'/>
            <h2>What Is Your Experience Mountain Biking?</h2>
            <p><input type="radio" name="experience" value="n00b"
                checked>n00b
                <input type="radio" name="experience" value="intermediate">Intermediate
                <input type="radio" name="experience" value="extreme">Extreme                   
                </p>
            <p><input type="submit" name="submit" value="Register"></p>
        </form>

最后，我有一个名为“registration”的sql数据库（我在本地运行xampp）我创建的表名为“userTable”，它包含8个字段，包括ID（自动递增）和其他7个我已包含在顶部的值。知道我做错了什么？

Answer 1

有什么问题？

1）问题是每次加载此页面时它都会执行INSERT查询 - 每次插入空值时都表示。为什么呢？

仅仅因为没有条件检查是否所有字段都已过帐，所以不是：

<?php

$fname = $_POST['fname'];
$lname = $_POST['lname'];
$password = $_POST['password'];
$email = $_POST['email'];
$cell = $_POST['cell'];
$experience = $_POST['experience'];
$ip = $_POST['ip'];

您应该检查$_POST超全局是否有某些键。因此，在进行任何查询之前 - 首先检查$_POST是否为空

<?php

//This means that user did submit the form
if ( !empty($_POST) ){

  //all your stuff goes here
}

?>
<html>
.....
</html>

2）您确定自己掌控了代码吗？显然不是。

您必须检查某个功能是否返回TRUE，然后依靠它执行以下操作。

例如，您确定mysql_query("your sql query")成功吗？

3）启用error_reporting到E_ALL，所以只需将error_reporting(E_ALL)放在页面顶部，如下所示：

<?php

error_reporting(E_ALL);

这样您就可以随时调试脚本＆＃34;飞行＆＃34;

4）你正在尽一切努力使这段代码难以维护，为什么？看看这个：

<?php

//Debug mode:
error_reporting(E_ALL);

//Sure you want to show some error if smth went wrong:
$errors = array(); 

/**
 * 
 * @return TRUE if connection established 
 * FALSE on error
 */
function connect(){

 $connection = mysql_connect(localhost, USERNAME, PASSWORD);
 $db = mysql_select_db(registration,$connection);    

 if (!$connection || !$db ){
   return false; 
 } else {
   return true;
 }
}


//So this code will run if user did submit the form:
if (!empty($_POST)){

 //Connect sql server:
 if ( !connect() ){
   $errors[] = "Can't establish link to MySQL server";
 }

 $fname = $_POST['fname'];
 $lname = $_POST['lname'];
 $password = $_POST['password'];
 $email = $_POST['email'];
 $cell = $_POST['cell'];
 $experience = $_POST['experience'];
 //Why post ip? not smth like $_SERVER['REMOTE_ADDR']...
 $ip = $_POST['ip'];

 $password = md5($_POST['password']);

 //No error at this point - means that it successfully connected to SQL server: 
 if ( empty($errors) ){

  //let's prevent sql injection:

  $fname = mysql_real_escape_string($fname);
  //Please do this for all of them..
 }



//Now we should try to INSERT the vals:

$query = "INSERT INTO `userTable` (`fname`,`lname`,`password`,`email`,`cell`,`experience`,`ip`) VALUES ('$fname', '$lname', '$password', '$email', '$cell', '$experience', '$ip')";

//So try it:
if ( !mysql_query($query) ){
   // 
   //die (mysql_error());
   $errors[] = "Can't insert the vals";
} else {
   //Or on success:
   print ("Thank you for your registration");
   //or you can do redirect to some page, like this:

  //header('location: /thanks.php');
}


}

?>

<form method="post">
            <h2>User Information</h2>

            <div><label>First Name:</label>
                <input type = "text" name = "fname"></div>
            <div><label>Last Name:</label>
                <input type = "text" name = "lname"></div>
            <div><label>Password:</label>
                <input type = "password" name = "password"></div>
            <div><label>Email:</label>
                <input type="text" name="email"></div>
            <div><label>Cellphone:</label>
                <input type="text" name="cell"></div>
                <input type="hidden" name="ip" value='<?php echo $IP ?>'/>
            <h2>What Is Your Experience Mountain Biking?</h2>
            <p><input type="radio" name="experience" value="n00b"
                checked>n00b
                <input type="radio" name="experience" value="intermediate">Intermediate
                <input type="radio" name="experience" value="extreme">Extreme                   
                </p>

            <?php if ( !empty($errors) ) : ?>

            <?php foreach($errors as $error): ?> 
             <p><b><?php echo $error; ?></b></p>
            <?php endforeach; ?> 
             <?php endif; ?>


            <p><input type="submit" name="submit" value="Register"></p>
        </form>

Answer 2

Solved my own problem


<?php
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$password = $_POST['password'];
$email = $_POST['email'];
$cell = $_POST['cell'];
$experience = $_POST['experience'];
$ip = $_POST['ip'];

$fname = mysql_real_escape_string($fname);
$lname = mysql_real_escape_string($lname);
$email = mysql_real_escape_string($email);
$password = md5($_POST['password']);

$servername="localhost";
$username="user";
$conn=  mysql_connect($servername,$username, password)or die(mysql_error());
mysql_select_db("registration",$conn);
$sql="insert into userTable (fname,lname,password,email,cell,experience,ip) VALUES ('$fname', '$lname', '$password', '$email', '$cell', '$experience', '$ip')";

$result=mysql_query($sql,$conn) or die(mysql_error());          
print "<h1>you have registered sucessfully</h1>";


echo "Thank you for your registration to the ";

mysql_close($connection);

＆GT;

PHP SQL注册表单

2 个答案: