Question

我在官方Facebook教程中做了Facebook注册插件，并在此代码中显示了屏幕上的总数：

if ($_REQUEST) {
  echo '<p>signed_request contents:</p>';
  $response = parse_signed_request($_REQUEST['signed_request'], 
                                   FACEBOOK_SECRET);
  echo '<pre>';
  print_r($response);
  echo '</pre>';
} else {
  echo '$_REQUEST is empty';
}

这给我带来了以下数组：

signed_request contents:

Array
(
    [algorithm] => HMAC-SHA256
    [expires] => 1324xxxx400
    [issued_at] => 132446xxx80
    [oauth_token] => AAADRjT73VhwBALl6Gb3EVarvyGU7xxxxxxxxxxxxxxxxxxxSAUuoZAGlydkX2pH3
    [registration] => Array
        (
            [name] => Philipp Mail
            [email] => p.mail@xxxxde
            [location] => Array
                (
                    [name] => Munich, Germany
                    [id] => 1.1604xxxxxx286E+14
                )

            [birthday] => xx/xx/19x7
        )
    [registration_metadata] => Array
        (
            [fields] => [{'name':'name'}, {'name':'email'}, {'name':'location'}, {'name':'birthday'}]
        )
    [user] => Array
        (
            [country] => de
            [locale] => de_DE
        )
    [user_id] => 10xxxxxxx5426
)

现在我将其更改为将几个数据存储到mysql：

if ($_REQUEST) {
  echo '<p>signed_request contents:</p>';
  $response = parse_signed_request($_REQUEST['signed_request'], 
                                       FACEBOOK_SECRET);
$name_arr = explode(' ',$name,2);
$vname = $name_arr[0];
$zname = isset($name_arr[1])?$name_arr[1]:'';
$email = $response["registration"]["email"];
$ort = $response["registration"]["location"]["name"];
$anrede = $response["registration"]["gender"];
$geburtstag = $response["registration"]["birthday"];

// Connecting to database
mysql_connect($dbhost, $dbuser, $dbpass) or die("MySQL Error: " . mysql_error());
mysql_select_db($dbname) or die("MySQL Error: " . mysql_error());

// Inserting into users table
$result = mysql_query("INSERT INTO REKRU_mem (mem_id, vname, zname, ort, email, userpass, chili, regdatum, geburtstag, fbuid) 
VALUES 
(NULL, '$vname', '$zname', '$ort', '$email',  MD5('".$gesamtpass."'),'$chili', '0000-00-00 00:00:00', '$geburtstag', '$user_fbid')");
if($result){         

// GOT RESULTS
}
else
{
// Error in storing
}
}
else 
{
echo '$_REQUEST is empty';
}

当我在注册后查看mysql时会有一个新行，但它只保存实际的注册时间。你们中的任何人都能看出我的错误吗？

Answer 1

不要在公共区域使用此代码！您可以进行SQL注入（也可能是您无法插入的问题）。试试这个而不是mysql_query：

$vname = mysql_real_escape_string($vname);
$zname = mysql_real_escape_string($zname);
$ort = mysql_real_escape_string($ort);
$email = mysql_real_escape_string($email);
$gesamtpass = mysql_real_escape_string($gesamtpass);
$chili = mysql_real_escape_string($chili);
$geburtstag = mysql_real_escape_string($geburtstag);
$user_fbid = mysql_real_escape_string($user_fbid);
$result = mysql_query("INSERT INTO REKRU_mem (mem_id, vname, zname, ort, email, userpass, chili, regdatum, geburtstag, fbuid) 
                                        VALUES (NULL, '".$vname."', '".$zname."', '".$ort."', '".$email."',  MD5('".$gesamtpass."'),'".$chili."', '0000-00-00 00:00:00', '".$geburtstag."', '".$user_fbid."')");

FB：registration - array不保存任何数据

1 个答案: