Question

我正在尝试将带有其他内容的图像添加到数据库并在此处进行攻击。问题是在数据库表中上传图像时。没有图像，一切都很好。我在数据库中使用了blob类型的图像。这是我的代码：

// studentrecords1.php
$submit=isset($_POST['submit']);
if($submit)
{

$name=$_GET['name'];
$email=$_GET['email'];
$phone=$_GET['phone'];
$school=$_GET['school'];
$father=$_GET['father'];
$dob=$_GET['dob'];
$feereceived=$_GET['feereceived'];
$due=$_GET['due'];


if(isset($_FILES['image']))
{

$image = addslashes(file_get_contents($_FILES['image']['tmp_name'])); 

}

$db = new mysqli("localhost", "root","","learndb");
$sql = "INSERT INTO studentrecords (Name, email, Phone, school,dob,father,feereceived,due,image) VALUES ('$name','$email','$phone','$school','$dob','$father','$feereceived','$due','$image')";
$result = $db->query($sql);

如果需要，这是我的html代码。

<form method="get" action="studentrecords1.php" enctype="multipart/form-data">
<p style="margin:5px">
Upload photo:<input type="file" name="image"><br><BR>
Your Full Name:<input type="Text" name="name" required><br><br>
Father;s Name:<input type="Text" name="father" required><br><br>
Date of birth:<input type="Text" name="dob" pattern="[0-9]{4}+\-[0-9]{2}+\-[0-9]{2}"placeholder="YYYY-MM-DD" required><br><br>
E-mail:<input type="Text" name="email" pattern="[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,3}$"required><br><br>
Phone no:<input type="Text" name="phone" required><br><br>
Your school/college:<input type="Text" name="school" required><br><br>
Fee Received(in Rs.):<input type="Text" name="feereceived" required><br><br>
Due Remaining(in Rs.):<input type="Text" name="due" required><br><br>
<input type="submit" name="submit" value="Enter information"></form>

我有一个奇怪的错误未定义变量：sql查询行中的图像，

Answer 1

您通过GET提交表单。您的文件无法通过GET上传。使用POST！

将method="get"更改为method="post"
将所有$_GET[]更改为$_POST[]，例如$_POST['name']
将$image设置为null，直接位于if(isset($_FILE['image']))之上，因此var始终存在。 Check your constraint that the image field may be null!
在保存到数据库之前对您的输入进行Sanatize
什么是if ($submit)？请改用if ($_SERVER['REQUEST_METHOD'] == 'POST')

Answer 2

您正在使用POST或GET ??

$submit=isset($_POST['submit']);

和

    $name=$_GET['name'];
    $email=$_GET['email'];
    $phone=$_GET['phone'];
    $school=$_GET['school'];
    $father=$_GET['father'];
    $dob=$_GET['dob'];
    $feereceived=$_GET['feereceived'];
    $due=$_GET['due'];

代码令人困惑。无论如何都不能使用GET上传文件，所以请改用POST。

Answer 3

试试这个

if(isset($_FILES['image']))
{

   $image = addslashes(file_get_contents($_FILES['image']['tmp_name'])); 

}

而不是

if(isset($_FILE['image']))
{

  $image = addslashes(file_get_contents($_FILES['image']['tmp_name'])); 

  }

Answer 4

我认为问题是：使用$image，此变量仅被声明if(isset($_FILE['image']))但是......如果不满足此条件，那么您的SQL引用的是甚至未声明的变量

在数据库php

4 个答案: