PHP-$数据库转义功能

时间:2018-11-18 22:35:32

标签: php database function escaping

当我尝试在管理员之间发送私人消息时,单击“发送”按钮后,返回此错误:

Fatal error: Uncaught Error: Call to a member function escape() on null in /members/site/sendMessage.php:7 Stack trace: #0 {main} thrown in /members/site/sendMessage.php on line 7

但是如果我在网址末尾手动添加“&msg = ok”,效果很好

这是文件“ sendMessage.php”的内容:

<?php
include_once("../../Account.php");
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");  

foreach ($_POST as $key => $value){
   $_POST[$key] = $database->escape ($value);
}

$uid = (int) $_POST['uid'];
$topic = $_POST['topic'];
$message = $_POST['message'];
$time = time();

$query = "INSERT INTO ".TB_PREFIX."mdata  SET target = $uid, owner = 1, topic = '$topic', message = '$message', viewed = 0, archived = 0, send = 0, time = $time, deltarget = 0, delowner = 0, coor = 0, report = 0";
mysqli_query($GLOBALS["link"], $query) OR DIE (mysqli_errno($GLOBALS["link"]));

header("Location: ../../admin.php?p=Newmessage&uid=".$uid."&msg=ok");
?>

如何解决?!?

0 个答案:

没有答案