Question

好的。我有这个比赛注册表单，有3个字段，将其插入mySQL DB ...以及通过电子邮件发送。我正在添加此代码，用于检查用户当前IP的表单，如果存在，则禁止提交。

现在似乎没有错误地执行...但它允许来自同一IP的多个提交。什么事都跳出来不正确？

以下完整代码：

<?php //include the connection file

require_once('connection.php');


function sanitize($value, $type)
{
$value = (!get_magic_quotes_gpc()) ? addslashes($value) : $value;

switch ($type) {
case "text":
$value = ($value != "") ? "'" . $value . "'" : "NULL";
break;
case "long":
case "int":
$value = ($value != "") ? intval($value) : "NULL";
break;
case "double":
  $value = ($value != "") ? "'" . doubleval($value) . "'" : "NULL";
  break;
case "date":
  $value = ($value != "") ? "'" . $value . "'" : "NULL";
  break;
}

return $value;
}

//save the data on the DB and send the email

if(isset($_POST['action']) && $_POST['action'] == 'submitform')
{
//recieve the variables

$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$ip = gethostbyname($_SERVER['REMOTE_ADDR']);

mysql_select_db($database, $connection);
$QUERY = "SELECT COUNT(IP) AS `count` FROM `contest` WHERE IP = 'value'";
$RESULT = mysql_query($QUERY) or die(mysql_error());

// Read the firs row
$row = mysql_fetch_assoc($RESULT);

// Check how many rows MySQL counted
if($row['count'] > 0) {
echo "value already exists";
}
else {

//save the data on the DB

mysql_select_db($database, $connection);

$insert_query = sprintf("INSERT INTO contest (First_Name, Last_Name, Email_Address, Date, ip) VALUES (%s, %s, %s, NOW(), %s)",
                        sanitize($firstname, "text"),
                        sanitize($lastname, "text"),
                        sanitize($email, "text"),
                        sanitize($ip, "text"));

$result = mysql_query($insert_query, $connection) or die(mysql_error());

if($result)
{
    //send the email

    $to = "EMAIL ADDY";
    $subject = "SUBJECT LINE";

    //headers and subject
    $headers  = "MIME-Version: 1.0rn";
    $headers .= "Content-type: text/html; charset=iso-8859-1rn";
    $headers .= "From: ".$firstname." <".$email.">rn";

    $body = "New contact
";
    $body .= "First Name: ".$firstname."
";
    $body .= "Last Name: ".$lastname."
";
    $body .= "Email: ".$email."
";
    $body .= "IP: ".$ip."
";

    mail($to, $subject, $body, $headers);

    //ok message

    header ('Location: thanks.html');
    exit ();
}
}
}

?>

Answer 1

您需要使用反引号而不是单引号来转义表名/保留字：

$QUERY = "SELECT COUNT(IP) AS `count` FROM `contest` WHERE IP = 'value'";

此外，如果您的IP列是字符串，则需要将的值括在单引号中： - ）

检查表中的IP地址 - mySQL PHP

1 个答案: