Question

我是MySQL和PHP的新手。我一直致力于一个像某种博客一样的项目。但是我听说旧MySQL易受攻击或容易被黑客攻击。所以我被建议使用PDO。但我很困惑如何将此代码转换为PDO。请帮帮我。

<?php

//Start session
session_start();

//Include database connection details
require_once('scripts/dblog.php');

//Array to store validation errors
$errmsg_arr = array();

//Validation error flag
$errflag = false;

//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
   $str = @trim($str);
   if(get_magic_quotes_gpc()) {
      $str = stripslashes($str);
   }
   return mysql_real_escape_string($str);
}

//Sanitize the POST values
$username = clean($_POST['username']);
$password = clean($_POST['password']);

//Input Validations
if($username == '') {
   $errmsg_arr[] = 'Username missing';
   $errflag = true;
}

if($password == '') {
   $errmsg_arr[] = 'Password missing';
   $errflag = true;
}

//If there are input validations, redirect back to the login form
if($errflag) {
   $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
   session_write_close();
   header("location: login.php");
   exit();
}

//Create query
$qry="SELECT * FROM member WHERE BINARY username='$username' AND BINARY password='$password'";
$result=mysql_query($qry);

//Check whether the query was successful or not
if($result) {
   if(mysql_num_rows($result) > 0) {
      //Login Successful
      session_regenerate_id();
      $member = mysql_fetch_assoc($result);
      $_SESSION['SESS_MEMBER_ID'] = $member['mem_id'];
      $_SESSION['SESS_FIRST_NAME'] = $member['username'];
      $_SESSION['SESS_LAST_NAME'] = $member['password'];

      session_write_close();
      header("location: post.php");
      exit();
   } else {
      //Login failed
      $errmsg_arr[] = '<div class="alert alert-error">user name and password not found</div>';
      $errflag = true;
      if($errflag) {
         $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
         session_write_close();
         header("location: login.php");
         exit();
      }
   }
} else {
   die("Query failed");
}
?>

Answer 1

没有人可能只是为你编写所有代码，但是我会给你一个非常好的工具来帮助你自己做这些：http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers，这样你甚至可以学习PDO背后的理论准备好的陈述：）

Answer 2

虽然这个问题过于局部化并且has been asked MANY times already - 只是为了向您展示更好的练习

您需要绑定参数。
最好少写代码。它可以节省您打字的时间
按tag wiki

所以，你走了

session_start();
require_once('scripts/dblog.php');

$sql = "SELECT * FROM member WHERE username=? AND password=?";
$stm = $pdo->prepare($sql);
$stm->execute($_POST);
$row = $stm->fetch();

if($row) {
    session_regenerate_id();
    $_SESSION['user'] = $row;
    $loc ='post.php';
} else {
    $_SESSION['ERRMSG_ARR'] = 'user name and password not found';
    $loc ='login.php';
}
session_write_close();
header("location: $loc");

Answer 3

您需要创建一个包含数据源名称的PDO对象，该名称是这样的字符串：

$dsn = "mysql:dbname=DATABASENAME;host=localhost;";

你像这样创建PDO对象，这基本上是mysql_connect（）的等价物：

$database = new PDO($dsn, "Username", "Password");

要执行您使用的查询:(等效于mysql_query（））

$query = $database->query("SELECT * FROM table where name = ?", ['Test']);

获取结果使用（eqivilent of mysql_fetch_array（））$query->fetchAll(PDO::FETCH_OBJ);

Answer 4

希望这会对你有所帮助

<?php
try {
    $dbh=new PDO('mysql:host=localhost;dbname=mysql','user','pass');

    $qry="SELECT * FROM member WHERE BINARY username='$username' AND BINARY password='$password'";
    //$result=mysql_query($qry);
    $result=$dbh->query($qry);
}catch (PDOException $e){
    print "PDO ERROR :".$e->getMessage()."<br/>";
    die();
}






//Check whether the query was successful or not
if($result) {
    if($result->rowCount() > 0) {
        //Login Successful
        session_regenerate_id();
        $member = $result->fetchAll(PDO::FETCH_ASSOC);
        $_SESSION['SESS_MEMBER_ID'] = $member['mem_id'];
        $_SESSION['SESS_FIRST_NAME'] = $member['username'];
        $_SESSION['SESS_LAST_NAME'] = $member['password'];
        session_write_close();
        header("location: post.php");
        exit();
    }else {
        //Login failed
        $errmsg_arr[] = '<div class="alert alert-error">user name and password not found</div>';
        $errflag = true;
        if($errflag) {
            $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
            session_write_close();
            header("location: login.php");
            exit();
        }
    }
}else {
    die("Query failed");
}
$dbh=null; //close pdo
?>

请帮我将PDO从旧的mysql转换为此代码

4 个答案: