我制作了一个脚本来删除游戏中的角色。 它很难。但是似乎拥有随机帐户（不拥有角色）的任何人都可以删除它们。 它会正确检查密码，密码等，只是不会检查字符名以匹配脚本上使用的玩家ID。
我希望这里的任何人都能帮助我。
这是脚本
我已经尝试添加字符名称检查，但是它在另一个表中，我不知道该怎么做。
这是基本的索引删除页面
<?php
include "config.php";
echo $_GET['error'];
?>
<form action="delete_char.php" method="post">
<table>
Please enter the required information to delete your character<br><br>
<tr><td>Character Name: <br /></td><td><input name="char_name" type="text" maxLength=10 size=13/><br />
<tr><td>Account: <br /></td><td><input name="use" type="text" maxLength=13 size=13/><br />
<tr><td>Password: <br /></td><td><input name="acc_pass" type="password" maxLength=10 size=13/><br />
<tr><td>PIN: <br /></td><td><input name="pin" type="text" maxLength=6 size=13/><br />
<tr><td colspan="2"><input type="submit" value="Ok"/></td></tr>
</table>
</form>
这是脚本。
<?php
include "config.php";
$char_name = $_POST['char_name'];
$use = $_POST['use'];
$acc_pass = $_POST['acc_pass'];
$pin = $_POST['pin'];
$con = mysql_connect($host, $user, $pass);
mysql_select_db($db);
$query = mysql_query("SELECT SSN, Password FROM Player WHERE PlayerID='$use'");
$row = mysql_fetch_array($query);
$count = mysql_num_rows($query);
$q = mysql_query("SELECT PASSWORD('$acc_pass') AS Password");
$p = mysql_fetch_array($q);
if($count == "0") {
$error = "Account not found!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
else {
if($p['Password'] != $row['Password']) {
$error = "Invalid password!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
if($row['LogOn'] == "GAME") {
$error = "Account is logged on!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
if($pin != $row['SSN']) {
$error = "Invalid PIN Number!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
else {
$q = mysql_query("SELECT CurrentWorldID FROM Player WHERE Name = '$use'");
$world_id = mysql_fetch_array($q);
$world_id = $world_id['CurrentWorldID'];
$del_query = mysql_query("DELETE FROM Slayer WHERE Name = '$char_name'");
$del_query = mysql_query("INSERT INTO DeleteChar (PlayerID, WorldID, Name, delDate) VALUES ('$use',$world_id,'$char_name',now())");
$del_query = mysql_query("DELETE FROM Vampire WHERE Name = '$char_name'");
$del_query = mysql_query("DELETE FROM Ousters WHERE Name = '$char_name'");
$del_query = mysql_query("DELETE FROM SkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireSkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersSkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RankBonusData WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM FlagSet WHERE OwnerID='$char_name'");
$del_query = mysql_query("DELETE FROM ARObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BeltObject WHERE OwnerID = '$char_name");
$del_query = mysql_query("DELETE FROM BladeObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BloodBibleObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BombMaterialObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BombObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BraceletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CastleSymbolObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CrossObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventGiftBoxObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventStarObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventTreeObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GloveObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM HelmObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM HolyWaterObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM KeyObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LearningItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MagazineObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MineObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MoneyObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MotorcycleObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM NecklaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PotionObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM QuestItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SMGObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SRObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SerumObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShieldObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShoesObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SkullObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SlayerPortalItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SwordObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TrouserObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireAmuletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireBraceletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireCoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireEarringObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireNecklaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampirePortalItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireWeaponObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireCoupleRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM WaterObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM DyePotionObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ResurrectItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MixingItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersArmsbandObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersBootsObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersChakramObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersCircletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersCoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersPendentObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersStoneObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersWristletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LarvaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PupaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ComposMeiObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersSummonItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CodeSheetObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MoonCardObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SweeperObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetFoodObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetEnchantItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LuckyBagObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SMSItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoreZapObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GQuestItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GQuestSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TrapItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CarryingReceiverObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShoulderArmorObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM DermisObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PersonaObject WHERE OwnerID = '$char_name");
$del_query = mysql_query("DELETE FROM FasciaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MittenObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SubInventoryObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleInfo WHERE FemalePartnerName = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleInfo WHERE MalePartnerName = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectAcidTouch WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectAftermath WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectBloodDrain WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectDetectHidden WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectFlare WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectLight WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectParalysis WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectPoison WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectPoisonousHands WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectProtectionFromParalysis WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectProtectionFromPoison WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectRestore WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectYellowPoisonToCreature WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectMute WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EnemyErase WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TimeLimitItems WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventQuestAdvance WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MofusPowerPoint WHERE OwnerID = '$char_name'");
$OK = "Character $char_name has been deleted.<hr size=2><br>";
header("Location: delete.php?error=$OK");
}
}
mysql_close($con);
好的脚本工作正常。
我希望脚本检查使用PlayerID进行验证的Char_name，以便只有所有者才能删除它。
答案 0 :(得分：3)
header不会立即结束脚本，即使重定向也是如此。您需要exit或执行其他操作以防止后续代码运行。在当前代码中，if检查密码和LogOn值设置了重定向标头，但不会阻止MySQL代码运行。可以通过改用elseif来解决，因此您得到的if..elseif..elseif..else(delete stuff)应该没问题。
但是，我想提出一些您需要修改的内容。
您正在将值直接注入查询中。如果我将角色名称提交为Niet' OR 1=1; --，那么我就已经建立了整个数据库。将代码更新为PDO并使用准备好的语句已经很久了。
您似乎在使用不安全的密码存储方法。您应该使用password_hash()和password_verify()来保护和验证密码。
您正在手动运行许多删除查询。这表明您的数据库没有以正确的关系方式设置。使用FOREIGN KEY约束使每个表强制与拥有它们的OwnerID保持适当的关系。这样，当您删除（或更新）Slayer记录时，该记录拥有的所有元素都将被删除（或更新）。这意味着您以后可以添加更多内容，而不必记住回到此代码并添加它。
您似乎正在使用任意字符串值（名称）作为表的键。相反，您应该使用诸如INT UNSIGNED AUTO_INCREMENT之类的主键-特别是，这将使您可以重命名Slayer，而不必更新指向该名称的每件事。
希望这会有所帮助！