【发布时间】:2015-09-28 09:20:31
【问题描述】:
我对 MySQL 很陌生。我正在尝试创建一个 php 脚本,它从 html 表单中读取数据并将其存储到数据库中。我还在上传一张图片,其路径保存在数据库中,图片本身存储在 c:wamp/www/uploads 中。现在,当我在提交表单后在我的 wamp 服务器上运行脚本时,我得到一个空白页。当我检查我的上传文件夹时,它仍然是空的。所以图像不会放入文件夹中。任何人都可以调试它吗?
<?php
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_DATABASE', 'userdatadelta');
$db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
$table= "CREATE TABLE `users`
( `rollno` int(15) NOT NULL,
`name` varchar(50) NOT NULL,
`email` varchar(50) NOT NULL,
`password` varchar(50) NOT NULL,
`imageid` varchar(50) NOT NULL,
PRIMARY KEY (`uid`),
UNIQUE KEY `username` (`email`))";
mysqli_query($db,$table);
if(isset($_POST["submit"]))
{
$name = $_POST["name"];
$roll_number = $_POST["rollno"];
$department = $_POST["department"];
$year = $_POST["year"];
$email = $_POST["email"];
$password = $_POST["password"];
$filename=$_FILES['userpic']['name'];
$filetype=$_FILES['userpic']['type'];
$name = mysqli_real_escape_string($db, $name);
$roll_number = mysqli_real_escape_string($db, $roll_number);
$department = mysqli_real_escape_string($db, $department);
$year = mysqli_real_escape_string($db, $year);
$email = mysqli_real_escape_string($db, $email);
$password = mysqli_real_escape_string($db, $password);
$password = md5($password);
$newfilename= $roll_number;
if($filetype=='image/jpeg' or $filetype=='image/png' or $filetype=='image/gif')
{
move_uploaded_file($_FILES['file']['tmp_name'],'upload/'.$newfilename);
$filepath="upload/".$newfilename;
}
$sql = "SELECT email FROM users WHERE email='$email'";
$result = mysqli_query($db,$sql);
$row = mysqli_fetch_array($result,MYSQLI_ASSOC);
if(mysqli_num_rows($result) == 1)
{
echo "An account has been created with this email ID already. We regret the inconvenience";
}
else
{
$query = mysqli_query($db, "INSERT INTO users (name, rollno, department, year, email, password, imagepath)VALUES ( '$name','$roll_number', $department, $year,'$email', '$password', '$filepath')");
if($query)
{
echo "Thank You! You have completed registration and are now registered.";
}
}
}
?>
编辑后的代码大部分都有效,但用于插入数据:(。2 cmets“已经使用此电子邮件 ID 创建了一个帐户。我们很抱歉给您带来不便”和“谢谢!您已完成注册并现在已注册。”似乎不起作用。
<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
$DB_SERVER="localhost";
$DB_USERNAME="root";
$DB_PASSWORD="";
$DB_DATABASE="userdatadelta";
$db = mysqli_connect( "$DB_SERVER" ,"$DB_USERNAME","$DB_PASSWORD","$DB_DATABASE")or die("Cannot connect");
echo "Got connected?";
if(isset($_POST["submit"]))
{
echo "Got inside isset!";
$name = $_POST["name"];
$roll_number = $_POST["rollno"];
$department = $_POST["department"];
$year = $_POST["year"];
$email = $_POST["email"];
$password = $_POST["password"];
$filename=$_FILES['userpic']['name'];
$filetype=$_FILES['userpic']['type'];
$name = mysqli_real_escape_string($db, $name);
$roll_number = mysqli_real_escape_string($db, $roll_number);
$department = mysqli_real_escape_string($db, $department);
$year = mysqli_real_escape_string($db, $year);
$email = mysqli_real_escape_string($db, $email);
$password = mysqli_real_escape_string($db, $password);
$password = md5($password);
$newfilename= $roll_number;
if($filetype=='image/jpeg' or $filetype=='image/png' or $filetype=='image/gif')
{
echo "Got inside file type checking!";
move_uploaded_file($_FILES['userpic']['tmp_name'],'upload/'.$newfilename);
$filepath="upload/".$newfilename;
}
$sql = "SELECT email FROM users WHERE email='$email'";
$result = mysqli_query($db,$sql);
$row = mysqli_fetch_array($result,MYSQLI_ASSOC);
if(mysqli_num_rows($result) == 1)
{
echo "An account has been created with this email ID already. We regret the inconvenience";
}
else
{
$query = mysqli_query($db, "INSERT INTO users (name, rollno, department, year, email, password, imagepath)VALUES ( '$name','$roll_number', $department, $year,'$email', '$password', '$filepath')");
echo "Got inside else!";
if($query)
{
echo "Thank You! You have completed registration and are now registered.";
}
}
}
echo "Comment!";
?>
【问题讨论】:
-
不显示。只是一个从 HTML 页面重定向的空白页面。
-
请注意,您的程序容易发生 sql 注入。你真的应该用谷歌搜索。此外,您尝试在每个请求上创建表。在第一次请求之后,它已经存在并且查询将失败。如果您的表存在,请检查数据库。
-
@AlbertHendriks 哦,是的,我已将其更正为“如果不存在”。我还认为 mysqli_real_escape_string 应该负责 sql 注入?错了吗?
-
对不起,我读了你的代码很快。你说得对。注意顺便说一句 md5 被卡了,你应该使用 sha256 stackoverflow.com/questions/1752477/…