【发布时间】:2018-12-26 17:28:20
【问题描述】:
我有一个 XAMPP 的本地实例正在运行,并且在那里一切正常。但是当将应用程序移植到 HostGator 时,我能够连接到数据库,但无法插入或选择。
我创建了一个拥有所有数据库权限的新用户,并将该用户附加到相关数据库。下面是我的代码(这里没有明显显示凭据):
dbconnect.php
$dbhost = 'localhost';
$dbuser = '(myuser)';
$dbpass = '(my pass)';
$db = '(mydb)';
$conn = mysqli_connect($dbhost,$dbuser, $dbpass,$db);
helper.php(从registration.php调用)
static function validateRegistration(){
if (isset($_POST)) {
//Gather And Sanitize User Input
@$username = sanitize($_POST["username"]);
@$firstname = sanitize($_POST["firstname"]);
@$lastname = sanitize($_POST["lastname"]);
@$email = sanitize($_POST["email"]);
@$email = (filter_var($email, FILTER_SANITIZE_EMAIL));
@$cellphone = sanitize($_POST["cellphone"]);
@$university = sanitize($_POST["university"]);
@$address = sanitize($_POST["address"]);
@$city = sanitize($_POST["city"]);
@$postcode = sanitize($_POST["postcode"]);
@$state = sanitize($_POST["state"]);
@$username = sanitize($_POST["username"]);
@$password = sanitize($_POST["password"]);
@$confirm = sanitize($_POST["confirm"]);
@$paymentmethod = sanitize($_POST["paymentmethod"]);
@$PaymentID = sanitize($_POST["PaymentID"]);
//Collect errors, if any are present
$errors = array();
if (strlen($firstname) <= 1 || strlen($firstname) > 32){
array_push($errors, 'First Name must be between 1 and 32 characters!');
}else{
}
if (strlen($lastname) <= 1 || strlen($lastname) > 32){
array_push($errors, 'Last Name must be between 1 and 32 characters!');
}
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
array_push($errors, 'E-Mail Address does not appear to be valid!');
}
if (strlen($cellphone) <= 2 || strlen($cellphone) >= 32) {
array_push($errors, 'Cell phone must be between 3 and 32 characters!');
}
if (strlen($address) <= 1 || strlen($address) >= 128) {
array_push($errors, 'Address 1 must be between 3 and 128 characters!');
}
if (strlen($city) <= 1 || strlen($city) >= 128) {
array_push($errors, 'City must be between 2 and 128 characters!');
}
if (strlen($postcode) <= 1 || strlen($postcode) >= 10) {
array_push($errors, 'Postcode must be between 2 and 10 characters!');
}
if (strlen($password) <= 3 || strlen($password) >= 20) {
array_push($errors, 'Password must be between 2 and 128 characters!');
}
if ($password != $confirm) {
array_push($errors, 'Your passwords do not match!');
}
}//END POST
//***********Check for available Username and Email***************//
include('dbconnect.php');
$registration = new RegistrationHelper();
$sql = "SELECT Username FROM User WHERE Username = '" . $username . "'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
array_push($errors, 'Username is already taken');
}
$sql = "SELECT Email FROM User WHERE Email = '" . $email . "'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
array_push($errors, 'Email is already taken.');
}
if(count($errors) > 0){
return $errors;
}else{
include('dbconnect.php');
//***************If we get this far, Register User - Will need admin approval***************
$saltedPass = base64_encode($registration->salt . $password . $registration->salt);
$insertSQL = "INSERT INTO User (Username, FirstName, LastName, Email, Cell, Password, Active, PaymentGateway, PaymentGatewayID)
Values ('" . $username . "', '" . $firstname . "', '" . $lastname . "', '" . $email . "', '" . $cellphone . "', '" . $saltedPass . "', 0, '" . $paymentmethod . "', '" . $PaymentID . "')";
$conn->query($insertSQL);
if ($conn->query($insertSQL) === TRUE) {
echo "New record created successfully";
$conn->close();
}
}
}//END validateRegistration()
代码在此函数中运行,但在 2 条 SELECT 语句上失败,
$conn->查询($sql);
$conn->查询($insertSQL);
而且也没有通过这个:
如果 ($conn->query($insertSQL) === TRUE) {
echo "记录创建成功";
$conn->close();
}
我已联系 HostGator 寻求他们的帮助,但他们不知道。用户拥有所有默认(完全)权限。代码没有改变,最终在 XAMPP 上本地运行。
【问题讨论】:
-
您对 SQL 注入持开放态度。由于您使用的是 mysqli,因此请利用 prepared statements 和 bind_param。 这将解决可能出现的任何令人讨厌的引用问题。
-
检查 mysqli errors 以找出您的 select 和 insert 语句会失败的原因。
-
没有错误,因为您不查找它们:) 将
ini_set('display_errors', 1); ini_set('log_errors',1); error_reporting(E_ALL); mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);添加到脚本顶部。这将强制任何mysqli_错误生成一个您可以在浏览器上看到的异常,并且其他错误也将在您的浏览器上可见。 -
请不要自己滚动密码散列 PHP 提供
password_hash()和password_verify()请使用它们。这里有一些good ideas about passwords如果你使用的是5.5之前的PHP版本there is a compatibility pack available here -
aynber,请再次查看我的代码。你会看到我正在调用一个 sanitize 函数来防止 SQL 注入 :)