Question

我制作了此表格，用户可以输入各种信息，一切都很好，我也在检查不同的错误，但是问题是，如果用户输入的电子邮件格式无效，而按sumbit按钮时，它将给出错误的无效电子邮件格式很好，但是mydatabase也存储了无效的电子邮件，如何防止存储一些无效的信息？我是编程新手。预先感谢。

$nameErr = $adressErr = $emailErr = $passwordErr = $genderErr = "";
$name = $adress = $email = $password = $gender = "";

if(isset($_POST['sumbit'])){
    if (empty($_POST["name"])){
        $nameErr = "Name is required";
    }else{
        $name = $_POST["name"];
        // check if name only contains letters and whitespace
            if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
      $nameErr = "Only letters and white space allowed"; 
    }
  }

    if(empty($_POST["adress"])){
        $adressErr = "Adress is required";
    }else{
        $adress = $_POST["adress"];
    }

    if(empty($_POST["email"])){
        $emailErr = "Email is required";
    }else{
        $email = $_POST["email"];
         // check if e-mail address is well-formed
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      $emailErr = "Invalid email format";
    }
}
    if(empty($_POST["password"])){
        $passwordErr = "Password is required";
    }else{
        $password = $_POST["password"];
    }

    if(empty($_POST["gender"])){
        $genderErr = "Gender is required";
    }else{
        $gender = $_POST["gender"];
    }
} 

$sql = "INSERT INTO users(name,adress,email,password,gender)VALUES(:name,:adress,:email,:password,:gender)";
$statement = $conn->prepare($sql);
$statement->bindParam(":name",$name);
$statement->bindParam(":adress",$adress);
$statement->bindParam(":email",$email);
$statement->bindParam(":password",$password);
$statement->bindParam(":gender",$gender);
$statement->execute();



?>

Answer 1

在顶部创建一个Boolean

$hasError = false;

在所有错误的情况下，将布尔值true设置为$hasError = true;

在sql查询之前：

if($hasError){
  // redirect to form page -- pass the ERROR in the url as get and then show the error on form page 
}
else{
 // execute query code
}

服务器端检查很好，您也可以在客户端添加很多验证。

客户端检查

对于电子邮件，您可以使用type='email'代替type='text'。同样，您可以使用maxlength，required等来避免错误数据。

Answer 2

您首先一个一个检查所有字段验证，然后执行插入查询。这就是在两种情况下输入总是有效或无效的情况下总是在数据库中创建新行的原因。如果只有输入有效，则应将插入查询放在块中。

尝试一下-

<?php
$nameErr = $adressErr = $emailErr = $passwordErr = $genderErr = "";
$name = $adress = $email = $password = $gender = "";
$error = array();
if(isset($_POST['sumbit'])){
    if (empty($_POST["name"])){
        $error[] = "Name is required";
    }else{
        $name = $_POST["name"];
        // check if name only contains letters and whitespace
            if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
      $error[] = "Only letters and white space allowed"; 
    }
  }

    if(empty($_POST["adress"])){
        $error[] = "Adress is required";
    }else{
        $error[] = $_POST["adress"];
    }

    if(empty($_POST["email"])){
        $error[] = "Email is required";
    }else{
        $email = $_POST["email"];
         // check if e-mail address is well-formed
            if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
              $error[] = "Invalid email format";
            }
        }
    if(empty($_POST["password"])){
        $error[] = "Password is required";
    }else{
        $password = $_POST["password"];
    }

    if(empty($_POST["gender"])){
        $error[] = "Gender is required";
    }else{
        $gender = $_POST["gender"];
    }
} 
if(empty($error)){
    $sql = "INSERT INTO users(name,adress,email,password,gender)VALUES(:name,:adress,:email,:password,:gender)";
    $statement = $conn->prepare($sql);
    $statement->bindParam(":name",$name);
    $statement->bindParam(":adress",$adress);
    $statement->bindParam(":email",$email);
    $statement->bindParam(":password",$password);
    $statement->bindParam(":gender",$gender);
    $statement->execute();
}else{
    foreach ($error as $key => $value) {
        echo '<li>'.$value.'</li>';
    }
}

?>

防止在SQL数据库中存储无效信息

2 个答案: