【发布时间】:2015-10-06 01:20:55
【问题描述】:
最近,我开始从一个网站获取机器人,该网站不断在我的“客户反馈”表单中发布他们的网站链接。我想让我的表单拒绝任何包含“http://”或我将添加的任何其他单词/短语的文本(他们肯定会找到绕过“http://”的方法),但事实是我没有不知道该怎么做。下面是代码(需要检查“http://”的形式是$name和$comment):
if(isset($_POST['add'])){
$name = $_POST['name'];
$email = $_POST['email'];
$comment = $_POST['comment'];
$ip = $_SERVER['REMOTE_ADDR'];
$datetime = date('Y-m-d H:i');
$checkIp = mysql_query("SELECT ip from comments WHERE ip = '$ip'");
if (mysql_num_rows($checkIp) > 0) {
echo "Only 1 feedback per IP allowed!";
$IP = mysql_fetch_array($checkIp);
print_r($IP);
}
if($name){
if($email){
if($comment){
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
mysql_query("INSERT INTO comments (id, name, email, comment, ip, datetime) VALUES ('','$name','$email','$comment','$ip','$datetime')");
}
else
echo "The email address is invalid!<br><br>";
}
else
echo "You haven't entered any comment!<br><br>";
}
else
echo "You haven't entered an email address!<br><br>";
}
else
echo "You haven't entered your name!<br><br>";
}
谢谢!
【问题讨论】:
-
为什么不使用captcha?
-
你有他们服务器的ip吗?
-
你应该了解安全性,你的代码对你来说很危险。