【问题标题】:MySQLI Connects, Doesn't INSERT/SELECT, No ErrorsMySQLI 连接,不插入/选择,没有错误
【发布时间】:2018-12-26 17:28:20
【问题描述】:

我有一个 XAMPP 的本地实例正在运行,并且在那里一切正常。但是当将应用程序移植到 HostGator 时,我能够连接到数据库,但无法插入或选择。

我创建了一个拥有所有数据库权限的新用户,并将该用户附加到相关数据库。下面是我的代码(这里没有明显显示凭据):

dbconnect.php

$dbhost = 'localhost';
$dbuser = '(myuser)';
$dbpass = '(my pass)';
$db     = '(mydb)';

$conn  = mysqli_connect($dbhost,$dbuser, $dbpass,$db);

helper.php(从registration.php调用)

static function validateRegistration(){
    if (isset($_POST)) {
    //Gather And Sanitize User Input
    @$username      = sanitize($_POST["username"]);
    @$firstname     = sanitize($_POST["firstname"]);
    @$lastname      = sanitize($_POST["lastname"]);
    @$email         = sanitize($_POST["email"]);
    @$email         = (filter_var($email,  FILTER_SANITIZE_EMAIL));
    @$cellphone     = sanitize($_POST["cellphone"]);
    @$university    = sanitize($_POST["university"]);
    @$address       = sanitize($_POST["address"]);
    @$city          = sanitize($_POST["city"]);
    @$postcode      = sanitize($_POST["postcode"]);
    @$state         = sanitize($_POST["state"]);
    @$username      = sanitize($_POST["username"]);
    @$password      = sanitize($_POST["password"]);
    @$confirm       = sanitize($_POST["confirm"]);
    @$paymentmethod = sanitize($_POST["paymentmethod"]);
    @$PaymentID     = sanitize($_POST["PaymentID"]);

    //Collect errors, if any are present
    $errors = array();
            
    if (strlen($firstname) <= 1  || strlen($firstname) > 32){
        array_push($errors, 'First Name must be between 1 and 32 characters!');
    }else{
    }
    if (strlen($lastname) <= 1 || strlen($lastname) > 32){
        array_push($errors, 'Last Name must be between 1 and 32 characters!');
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      array_push($errors, 'E-Mail Address does not appear to be valid!');
    }
    if (strlen($cellphone) <= 2 || strlen($cellphone) >= 32) {
      array_push($errors, 'Cell phone must be between 3 and 32 characters!');
    }
    if (strlen($address) <= 1 || strlen($address) >= 128) {
      array_push($errors, 'Address 1 must be between 3 and 128 characters!');
    }
    if (strlen($city) <= 1 || strlen($city) >= 128) {
      array_push($errors, 'City must be between 2 and 128 characters!');
    }
    if (strlen($postcode) <= 1 || strlen($postcode) >= 10) {
      array_push($errors, 'Postcode must be between 2 and 10 characters!');
    }
    if (strlen($password) <= 3 || strlen($password) >= 20) {
      array_push($errors, 'Password must be between 2 and 128 characters!');
    }
    if ($password != $confirm) {
      array_push($errors, 'Your passwords do not match!');
    }
}//END POST


//***********Check for available Username and Email***************//
include('dbconnect.php');
$registration = new RegistrationHelper();  
$sql = "SELECT Username FROM User WHERE Username = '" . $username . "'";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    array_push($errors, 'Username is already taken');
}
$sql = "SELECT Email FROM User WHERE Email = '" . $email . "'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
    array_push($errors, 'Email is already taken.');
}


if(count($errors) > 0){
    return $errors;
}else{
    include('dbconnect.php');
    //***************If we get this far, Register User - Will need admin approval***************
    $saltedPass = base64_encode($registration->salt . $password . $registration->salt); 
    $insertSQL = "INSERT INTO User (Username, FirstName, LastName, Email, Cell, Password, Active, PaymentGateway, PaymentGatewayID)
        Values ('" . $username . "', '" . $firstname . "', '" . $lastname . "', '" . $email . "', '" . $cellphone . "', '" . $saltedPass . "', 0, '" . $paymentmethod . "', '" . $PaymentID . "')";
    $conn->query($insertSQL);

    if ($conn->query($insertSQL) === TRUE) {
        echo "New record created successfully";
        $conn->close();

    }   

}


}//END validateRegistration()

代码在此函数中运行,但在 2 条 SELECT 语句上失败,

$conn->查询($sql);

$conn->查询($insertSQL);

而且也没有通过这个:

如果 ($conn->query($insertSQL) === TRUE) {

echo "记录创建成功";

$conn->close();

}

我已联系 HostGator 寻求他们的帮助,但他们不知道。用户拥有所有默认(完全)权限。代码没有改变,最终在 XAMPP 上本地运行。

【问题讨论】:

  • 您对 SQL 注入持开放态度。由于您使用的是 mysqli,因此请利用 prepared statementsbind_param这将解决可能出现的任何令人讨厌的引用问题。
  • 检查 mysqli errors 以找出您的 select 和 insert 语句会失败的原因。
  • 没有错误,因为您不查找它们:)ini_set('display_errors', 1); ini_set('log_errors',1); error_reporting(E_ALL); mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT); 添加到脚本顶部。这将强制任何mysqli_ 错误生成一个您可以在浏览器上看到的异常,并且其他错误也将在您的浏览器上可见。
  • 请不要自己滚动密码散列 PHP 提供 password_hash()password_verify() 请使用它们。这里有一些good ideas about passwords如果你使用的是5.5之前的PHP版本there is a compatibility pack available here
  • aynber,请再次查看我的代码。你会看到我正在调用一个 sanitize 函数来防止 SQL 注入 :)

标签: php mysqli xampp


【解决方案1】:

显然我的本地 MySQL 实例不区分大小写,但在 HostGator 实例上,它是区分大小写的。通过匹配数据库表的大小写,我能够解决问题。

【讨论】:

    猜你喜欢
    • 1970-01-01
    • 2013-07-12
    • 2014-04-12
    • 1970-01-01
    • 2012-08-21
    • 2013-11-29
    • 1970-01-01
    • 2011-02-10
    • 2013-05-17
    相关资源
    最近更新 更多