Question

我有一个通过我的div textarea发送的值或newmsg，这可以包含@mention文本或者只是文本，具体取决于用户输入状态更新程序的内容。

我面临的问题是，当我添加str_replace代码来转换@mention +文本时，它是否会发布带有@mention +文本的任何内容，但不会发布只有文本的正常状态。我需要我的php脚本来发布它们。

如果它有@metion +文字帖子

<a href="profile.php?username='.isset($_POST['red']).'">@mention</a> Hi my name is Dave

或者如果它只是没有@mention的文本

Hi my name is Dave

PHP

if(isset($_POST['toid'])){
    if($_POST['toid']==""){$_POST['toid']=$_SESSION['id'];}


if(isset($_POST['newmsg'])&&isset($_POST['toid'])&&isset($_POST['privacy'])&&isset($_POST['red'])){


$_POST['newmsg']=str_replace('@'.isset($_POST['red']).'','<a href="profile.php?username='.isset($_POST['red']).'">'.isset($_POST['red']).'</a>', $_POST['newmsg']);

$sql="SELECT * FROM user WHERE id=".$_SESSION['id']."";
$query=mysqli_query($mysqli,$sql) or die(mysqli_error($mysqli));
$row = mysqli_fetch_assoc($query);
 date_default_timezone_set($row['timezone']);
$date=date('y:m:d H:i:s');
        if($_POST['toid']==$_SESSION['id']){
            user_core::create_streamitem("1",mysqli_real_escape_string($mysqli,$_SESSION['id']),mysqli_real_escape_string($mysqli,$_POST['newmsg']),mysqli_real_escape_string($mysqli,$_POST['privacy']),mysqli_real_escape_string($mysqli,$_POST['toid']),mysqli_real_escape_string($mysqli,$date));
        }else{
            user_core::create_streamitem("3",mysqli_real_escape_string($mysqli,$_SESSION['id']),mysqli_real_escape_string($mysqli,$_POST['newmsg']),mysqli_real_escape_string($mysqli,$_POST['privacy']),mysqli_real_escape_string($mysqli,$_POST['toid']),mysqli_real_escape_string($mysqli,$date));
        }
    }

}

AJAX

var content = $(this).children("#toid").val();
            var newmsg= $(this).children("#newmsg").text();
           var username = $(".red").attr("href");
            var privacy = $("#privacy").val();
            $.ajax({
            type: "POST",
            url: "insert.php",
            cache: false,
            dataType: "json",
            data: { toid: content, newmsg: newmsg, privacy: privacy, red: username }, 
            success: function(response){ }

我仍然必须转义我的变量以防止sql注入。

Answer 1

我已经开始工作了。我删除了$ _POST ['red']并将其包裹在str_replace

周围

if(isset($_POST['toid'])){
    if($_POST['toid']==""){$_POST['toid']=$_SESSION['id'];}


if(isset($_POST['newmsg'])&&isset($_POST['toid'])&&isset($_POST['privacy'])){

if(isset($_POST['red']){
$_POST['newmsg']=str_replace('@'.isset($_POST['red']).'','<a href="profile.php?username='.isset($_POST['red']).'">'.isset($_POST['red']).'</a>', $_POST['newmsg']);
}
$sql="SELECT * FROM user WHERE id=".$_SESSION['id']."";
$query=mysqli_query($mysqli,$sql) or die(mysqli_error($mysqli));
$row = mysqli_fetch_assoc($query);
 date_default_timezone_set($row['timezone']);
$date=date('y:m:d H:i:s');
        if($_POST['toid']==$_SESSION['id']){
            user_core::create_streamitem("1",mysqli_real_escape_string($mysqli,$_SESSION['id']),mysqli_real_escape_string($mysqli,$_POST['newmsg']),mysqli_real_escape_string($mysqli,$_POST['privacy']),mysqli_real_escape_string($mysqli,$_POST['toid']),mysqli_real_escape_string($mysqli,$date));
        }else{
            user_core::create_streamitem("3",mysqli_real_escape_string($mysqli,$_SESSION['id']),mysqli_real_escape_string($mysqli,$_POST['newmsg']),mysqli_real_escape_string($mysqli,$_POST['privacy']),mysqli_real_escape_string($mysqli,$_POST['toid']),mysqli_real_escape_string($mysqli,$date));
        }
    }

}

@mention包含文本或仅包含文本

1 个答案: