Question

我的网站是管理员登录网站，因此用户无法注册。但是，他们可以发布评论到该网站。我删除了评论中的按钮，但没有意识到任何人都可以删除任何评论。我怎么能改变这一点，所以当管理员登录时，他们能够删除不适当的评论（如果有的话），并从公众中删除删除按钮。

这是我的Comment.php代码，其中包含删除按钮功能：

   <?php 

   session_start();
   require_once 'templates/open.php';
   require_once 'connect.php';
   require_once 'functions/cleanstring.php';
   require_once 'functions/encrypt.php';

   ?>

另一个代码文件：

   <?php
   $db_hostname = 'localhost';
   $db_database = 'cs12e2g_MyFirstDB'; //'Your database name'
   $db_username = 'cs12e2g_DBuser'; //'your username';
   $db_password = 'vtjppqs7'; //'Your password';
   $db_status = 'not initialised';
   $db_server = mysqli_connect($db_hostname, $db_username, $db_password);
   $db_status = "connected";
   if (!$db_server){
die("Unable to connect to MySQL: " . mysqli_connect_error());
$db_status = "not connected";
   }


    // Includes and variables always required

    require_once 'recaptcha/recaptchalib.php';
    require_once 'functions/cleanstring.php';
    $privatekey = "6Lem4-gSAAAAADsaa9KXlzSAhLs8Ztp83Lt-x1kn";
    $publickey = "6Lem4-gSAAAAAMHLAVbieIknMtUZo71ZKzzCkoFN";
    mysqli_select_db($db_server, $db_database);

    $str_message = "";
    if (!$db_server){
        die("Unable to connect to MySQL: " . mysqli_connect_error());
    }else{

        if(isset($_GET['delete'])){
            $deleteq="DELETE FROM comments WHERE ID={$_GET['delete']} LIMIT 1";

            $deleter=mysqli_query($db_server, $deleteq);
            IF($deleter){
                echo"<p>That message was deleted!</p>";}}




        //Test whether form has been submitted 
        if(trim($_POST['submit']) == "Submit"){
            //Handle submission
            $resp = recaptcha_check_answer ($privatekey,
                                            $_SERVER["REMOTE_ADDR"],
                                            $_POST["recaptcha_challenge_field"],
                                            $_POST["recaptcha_response_field"]);
            if (!$resp->is_valid) {
                // What happens when the CAPTCHA was entered incorrectly
                $str_message = "The reCAPTCHA wasn't entered correctly. Go back and try it          
    again. 
                                (reCAPTCHA said: " . $resp->error . ")";
            } else {

                // Your code here to handle a successful verification
               $comment = $_POST['comment'];
                if($comment != ""){
                    $query = "INSERT INTO comments (comment) VALUES ('$comment')";
                    mysqli_query($db_server, $query) or die("Comment insert failed: " .        
    mysqli_error($db_server) );
                    $str_message = "Thanks for your comment!";
                }else{
                    $str_message = "Invalid form submission";
                }
            }
        }
        //Create page with or without submission 
        $query = "SELECT * FROM comments";
        $result = mysqli_query($db_server, $query);
        if (!$result) die("Database access failed: " . mysqli_error($db_server) );
        while($row = mysqli_fetch_array($result)){ 
        $ID= $row['ID'];
            $str_result .=  "<p><em>Comment $j (" . $row['commDate'] . 
                    ")</em><br /> " .$row['comment'] . "</p>
                    <a href ='commentnow.php?delete=$ID
                    '>Delete</a><hr />"; 
        }
        mysqli_free_result($result);
    } 

     ?>




    <h1>What do you think?</h1>


   <p><h5>Did you find everything you wanted? Please comment below:<h5></p>

    <form action="commentnow.php" method="post">
        <textarea rows="10" cols="50" name="comment"></textarea><br />
        <?php echo recaptcha_get_html($publickey); ?>
        <input type="submit" name="submit" value="Submit" /> 
    </form> 
    <span style="color:#FF0000;">
    <?php echo $str_message; ?></span>
    <hr /> 
    <h2>Comments:</h2>
    <?php echo $str_result; ?> 




    </div>

     <?php
require_once 'templates/close.php';


?>

我有一个members.php页面，对应于管理员登录时（他们是唯一可以访问此页面的人），删除按钮代码必须在这里吗？所以他们是唯一可以使用这个功能的人吗？如果是这样，它会去哪里，以及如何？

Answer 1

限制删除按钮仅显示给管理员。这也意味着你以某种方式识别登录用户是否是管理员。

if ($is_admin) {
// Code to display button
}

同样在后端检查登录用户是否为admin

if ($is_admin) {
    // Code to delete comment
    delete_comment();
}

Answer 2

欢迎来到php。

您可以识别在您的应用程序中输入的用户。

使用数据库或数组或文件或变量等

如果权限等于admin或编辑器（例如）允许删除。

例如

if( $login == 'admin' ){
     // Allow action
}

我明白了吗？

（我的英语不好，对不起）

使用PHP从数据库中删除注释

2 个答案: