删除脚本

时间：2019-06-16 14:49:23

标签： php mysql mysql4

我制作了一个脚本来删除游戏中的角色。 它很难。但是似乎拥有随机帐户（不拥有角色）的任何人都可以删除它们。 它会正确检查密码，密码等，只是不会检查字符名以匹配脚本上使用的玩家ID。

我希望这里的任何人都能帮助我。

这是脚本

我已经尝试添加字符名称检查，但是它在另一个表中，我不知道该怎么做。

这是基本的索引删除页面

<?php
 include "config.php";
  echo $_GET['error'];
?>

<form action="delete_char.php" method="post">
  <table>
    Please enter the required information to delete your character<br><br>
    <tr><td>Character Name: <br /></td><td><input name="char_name" type="text" maxLength=10 size=13/><br />
    <tr><td>Account: <br /></td><td><input name="use" type="text" maxLength=13 size=13/><br />
    <tr><td>Password: <br /></td><td><input name="acc_pass" type="password" maxLength=10 size=13/><br />
    <tr><td>PIN: <br /></td><td><input name="pin" type="text" maxLength=6 size=13/><br />
    <tr><td colspan="2"><input type="submit" value="Ok"/></td></tr>
  </table>
</form>

这是脚本。

<?php
  include "config.php";
  $char_name = $_POST['char_name'];
  $use = $_POST['use'];
  $acc_pass = $_POST['acc_pass'];
  $pin = $_POST['pin'];

  $con = mysql_connect($host, $user, $pass);
  mysql_select_db($db);

  $query = mysql_query("SELECT SSN, Password FROM Player WHERE PlayerID='$use'");

  $row = mysql_fetch_array($query);
  $count = mysql_num_rows($query);

  $q = mysql_query("SELECT PASSWORD('$acc_pass') AS Password");
  $p = mysql_fetch_array($q);

  if($count == "0") {
    $error = "Account not found!<hr size=2><br>";
    header("Location: delete.php?error=$error");
  }
  else {
    if($p['Password'] != $row['Password']) {
      $error = "Invalid password!<hr size=2><br>";
      header("Location: delete.php?error=$error");
    }

    if($row['LogOn'] == "GAME") {
      $error = "Account is logged on!<hr size=2><br>";
      header("Location: delete.php?error=$error");
    }

    if($pin != $row['SSN']) {
      $error = "Invalid PIN Number!<hr size=2><br>";
      header("Location: delete.php?error=$error");
    }

    else {
      $q = mysql_query("SELECT CurrentWorldID FROM Player WHERE Name = '$use'");
      $world_id = mysql_fetch_array($q);
      $world_id = $world_id['CurrentWorldID'];

      $del_query = mysql_query("DELETE FROM Slayer WHERE Name = '$char_name'");
      $del_query = mysql_query("INSERT INTO DeleteChar (PlayerID, WorldID, Name, delDate) VALUES ('$use',$world_id,'$char_name',now())");
      $del_query = mysql_query("DELETE FROM Vampire WHERE Name = '$char_name'");
      $del_query = mysql_query("DELETE FROM Ousters WHERE Name = '$char_name'");
      $del_query = mysql_query("DELETE FROM SkillSave WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireSkillSave WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersSkillSave WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM RankBonusData WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM FlagSet WHERE OwnerID='$char_name'");
      $del_query = mysql_query("DELETE FROM ARObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM BeltObject WHERE OwnerID = '$char_name");
      $del_query = mysql_query("DELETE FROM BladeObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM BloodBibleObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM BombMaterialObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM BombObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM BraceletObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CastleSymbolObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CoatObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CrossObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ETCObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventETCObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventGiftBoxObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventStarObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventTreeObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM GloveObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM HelmObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM HolyWaterObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM KeyObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM LearningItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MaceObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MagazineObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MineObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MoneyObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MotorcycleObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM NecklaceObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PotionObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM QuestItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SMGObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SRObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SerumObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ShieldObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ShoesObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SkullObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SlayerPortalItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SwordObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM TrouserObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM RingObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CoupleRingObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireAmuletObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireBraceletObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireCoatObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireETCObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireEarringObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireNecklaceObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampirePortalItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireRingObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireWeaponObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM VampireCoupleRingObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM WaterObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM DyePotionObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ResurrectItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MixingItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersArmsbandObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersBootsObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersChakramObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersCircletObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersCoatObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersPendentObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersRingObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersStoneObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersWristletObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM LarvaObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PupaObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ComposMeiObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM OustersSummonItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CodeSheetObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MoonCardObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SweeperObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PetItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PetFoodObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PetEnchantItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM LuckyBagObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SMSItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CoreZapObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM GQuestItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM GQuestSave WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM TrapItemObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CarryingReceiverObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM ShoulderArmorObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM DermisObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM PersonaObject WHERE OwnerID = '$char_name");
      $del_query = mysql_query("DELETE FROM FasciaObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MittenObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM SubInventoryObject WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM CoupleInfo WHERE FemalePartnerName = '$char_name'");
      $del_query = mysql_query("DELETE FROM CoupleInfo WHERE MalePartnerName = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectAcidTouch WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectAftermath WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectBloodDrain WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectDetectHidden WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectFlare WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectLight WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectParalysis WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectPoison WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectPoisonousHands WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectProtectionFromParalysis WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectProtectionFromPoison WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectRestore WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectYellowPoisonToCreature WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EffectMute WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EnemyErase WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM TimeLimitItems WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM EventQuestAdvance WHERE OwnerID = '$char_name'");
      $del_query = mysql_query("DELETE FROM MofusPowerPoint WHERE OwnerID = '$char_name'");

      $OK = "Character $char_name has been deleted.<hr size=2><br>";
      header("Location: delete.php?error=$OK");
    }
  }
  mysql_close($con);

好的脚本工作正常。

我希望脚本检查使用PlayerID进行验证的Char_name，以便只有所有者才能删除它。

1 个答案:

答案 0 :(得分：3)

header不会立即结束脚本，即使重定向也是如此。您需要exit或执行其他操作以防止后续代码运行。在当前代码中，if检查密码和LogOn值设置了重定向标头，但不会阻止MySQL代码运行。可以通过改用elseif来解决，因此您得到的if..elseif..elseif..else(delete stuff)应该没问题。

但是，我想提出一些您需要修改的内容。

  1. 您正在将值直接注入查询中。如果我将角色名称提交为Niet' OR 1=1; --，那么我就已经建立了整个数据库。将代码更新为PDO并使用准备好的语句已经很久了。

  2. 您似乎在使用不安全的密码存储方法。您应该使用password_hash()和password_verify()来保护和验证密码。

  3. 您正在手动运行许多删除查询。这表明您的数据库没有以正确的关系方式设置。使用FOREIGN KEY约束使每个表强制与拥有它们的OwnerID保持适当的关系。这样，当您删除（或更新）Slayer记录时，该记录拥有的所有元素都将被删除（或更新）。这意味着您以后可以添加更多内容，而不必记住回到此代码并添加它。

  4. 您似乎正在使用任意字符串值（名称）作为表的键。相反，您应该使用诸如INT UNSIGNED AUTO_INCREMENT之类的主键-特别是，这将使您可以重命名Slayer，而不必更新指向该名称的每件事。

希望这会有所帮助！

相关问题
最新问题