【发布时间】:2017-03-23 07:35:42
【问题描述】:
所以这是我的 PHP 脚本,用于将分数从 unity 插入到 php
<?php
// create the connection to our database with following values: location of our databse
// (with xampp it's "localhost"), next is the login ("name" and "password").
// if the connection can not be established we get an error message, that we've entered after "or die"
$sql_connect = mysqli_connect("localhost", "id1151441_dbtest", "newcreator123") or die ("no DB Connection");
// after we're logged in, we can call our database
mysqli_select_db($sql_connect,"id1151441_dbtest123") or die ("DB not found");
// now we store our sent information from Unity in php variables, we can work with
if(isset(($_GET['newName']))){
$name = $_GET['newName'];
}
if(isset($_GET['newScore'])){
$score = $_GET['newScore'];
}
// Now we simply add/insert our values into our "highscores" table
// we first choose the columns and then add our values
// we don't need to fill in any value into the ID part, as it automatically gets a new value depending on the entries
mysqli_query($sql_connect,"INSERT INTO getdataofplayer (Name, Score) VALUES ($name,$score);");
// we're done now, so we can close the connection
mysqli_close($sql_connect);
?>
我有这个错误: 未定义变量:/storage/h10/441/1151441/public_html/InsertScore.php 第 21 行中的名称
在我的 wwwform Unity 脚本中是这样的:
using UnityEngine;
using System.Collections;
using UnityEngine.UI;
public class HighScoreController : MonoBehaviour
{
public string Name;
public int Score;
public string db_url = "http://testleaderboard.000webhostapp.com";
public GameObject textScreen;
void Update(){
if(Input.GetKeyDown(KeyCode.Space)){
SaveScore ();
}
}
public void SaveScore(){
StartCoroutine(SaveScores());
}
IEnumerator SaveScores(){
// first we create a new WWWForm, that means a "post" command goes out to our database (for futher information just google "post" and "get" commands for html/php
WWWForm form = new WWWForm();
// with this line we will give a new name and save our score into that name
// those "" indicate a string and attach the score after the comma to it
form.AddField("newName", Name);
form.AddField("newScore", Score);
// the next line will start our php file that saves the Score and attaches the saved values from the "form" to it
// For this tutorial I've used a new variable "db_url" that stores the path
WWW webRequest = new WWW(db_url + "InsertScore.php", form);
// with this line we'll wait until we get an info back
yield return webRequest;
if (webRequest.error != null) {
Debug.Log (webRequest.error);
} else {
Debug.Log (webRequest.text);
}
}
IEnumerator LoadScores(){
// we don't need to store any variable in this, just run the php file
WWW webRequest = new WWW(db_url + "index.php");
// now we wait again for the feedback of the command
yield return webRequest;
// this is a GUIText that will display the scores in game.
textScreen.GetComponent<Text>().text = webRequest.text;
Debug.Log (webRequest);
}
}
我已经被困了 5 个小时,只是因为我的 php 脚本上出现了这个未定义的变量错误,有人可以帮助我吗?提前谢谢你
【问题讨论】:
-
您对SQL Injections 持开放态度,应该真正使用Prepared Statements,而不是连接您的查询。特别是因为您根本没有逃避用户输入!
-
由于您在
if--statements 中创建变量,它们未定义的唯一原因是if-statements 未验证为真。转储/记录$_GET变量并检查它包含的内容。在尝试更新数据库之前,您可能还应该添加一个检查以查看是否设置了两个变量。 -
@MagnusEriksson 我将其更新为 $name = mysqli_real_escape_string($sql_connect,$_GET['newName']); $score = mysqli_real_escape_string($sql_connect,$_GET['newScore']);
-
@MagnusEriksson 这是空先生。为什么它是空的?未定义的索引:/storage/h10/441/1151441/public_html/InsertScore.php 中的用户名第 25 行 NULL i var_dump($_GET['userName']);我明白了
-
1. 您应该改用预处理语句(更安全)。 2. 除非
newScore是一个字符串,否则您不应该使用mysqli_real_escape_string(),因为那是用于...字符串。将分数转换为整数:$score = (int) $_GET['newScore'];。(使用准备好的语句时不需要)3。您需要在 SQLVALUES ('$name', ...)中的字符串值周围加上单引号。 (使用准备好的语句时不需要)4. 如果值不存在,isset()将验证为 false 或为空。