【发布时间】：2014-03-01 11:35:54
【问题描述】：
我已经坚持了一段时间了。我有一个位于index.php 的表格。数据被发送到一个名为processuserform.php 的php 文件。我提取所有输入并将它们分配给它们自己的变量。以下看起来是否是在服务器端验证和清理表单的正确方法？
首先是表单本身，然后 PHP 文件将用于处理发送给它的数据。
<form method="POST" name="signup" action="php/processuserform.php">
<input id="firstname" onkeyup="validateFirstName()" placeholder="First Name" type="text" /><label id="firstnameprompt"></label>
<br><br>
<input id="lastname" onkeyup="validateLastName()" placeholder="Last Name" type="text"/>
<label id="lastnameprompt"></label>
<br><br>
<input id="Email" onkeyup="validateEmail()" placeholder="Email" type="text" />
<label id="Emailprompt"></label>
<br /><br />
<input id="Password" onkeyup="validatePassword()" placeholder="Create Password" type="password" /><label id="Passwordprompt"></label>
<br /><br />
<strong>Male</strong><input id="Gender" type="radio" name="sex" value="male">
<strong>Female</strong><input id="Gender" type="radio" name="sex" value="female">
<br /><br />
Click "Submit" if you agree to <a href="#">"Terms And Conditions"</a>
<br>
<input id="submit" onclick="return validateUserRegistration()" value="Submit" type="submit" name="submit"/>
<label id="submitprompt"></label>
<br><br>
processuserform.php
<?php
$first_name = ($_POST['firstname']);
$last_name = ($_POST['lastname']);
$email = ($_POST['Email']);
$pw = ($_POST['Password']);
$gender = ($_POST['Gender']);
// define variables and set to empty values
$first_nameErr = $last_nameErr = $emailErr = $pwErr = $genderErr = "";
$first_name = $last_name = $email = $pw = $gender = "";
if ($_SERVER["REQUEST_METHOD"] == "POST")
{
if (empty($_POST["firstname"]))
{
$first_nameErr = "Name is required";
}
else
{
$first_name = test_input($_POST["firstname"]);
// check if name only contains letters and whitespace
if (!preg_match("/^[a-zA-Z ]*$/",$first_name))
{
$first_nameErr = "Only letters and white space allowed";
}
}
if ($_SERVER["REQUEST_METHOD"] == "POST")
{
if (empty($_POST["lastname"]))
{
$last_nameErr = "Name is required";
}
else
{
$last_name = test_input($_POST["lastname"]);
// check if name only contains letters and whitespace
if (!preg_match("/^[a-zA-Z ]*$/",$last_name))
{
$last_nameErr = "Only letters and white space allowed";
}
}
if (empty($_POST["Email"]))
{
$emailErr = "Email is required";
}
else
{
$email = test_input($_POST["email"]);
// check if e-mail address syntax is valid
if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email))
{
$emailErr = "Invalid email format";
}
}
if (empty($_POST["Password"]))
{
$pwErr = "Password is required";
}
else
{
$pw = test_input($_POST["Password"]);
}
}
if (empty($_POST["Gender"]))
{
$genderErr = "Gender is required";
}
else
{
$gender = test_input($_POST["Gender"]);
}
}
function test_input($data)
{
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
$hostname="this is correct";
$username="this is correct";
$password="this is correct";
$dbname="this is correct";
$db_conx = mysqli_connect($hostname, $username, $password) OR DIE ("Unable to connect to database! Please try again later.");
if(mysqli_connect_errno())
{
echo mysqli_connect_error();
exit();
}
$select = mysqli_select_db($db_conx,$dbname);
mysqli_query($db_conx,"INSERT INTO users (firstname, lastname, email, password, gender)
VALUES ('$first_name', '$last_name', '$email', '$pw', '$gender')");
mysqli_close($db_conx);
header("Location: not/important.php")
?>
感谢大家的帮助。如果我正在对其进行消毒并错误地验证它，有人会介意以我的一个输入为例给我一个示例，说明它的外观吗？我可以使用帮助，因为这有点令人困惑。再次感谢！
【问题讨论】：
标签： php forms validation sanitization