php - 我需要 PDO 连接成功的确认

Question

我已经阅读了很多关于此的帖子，但似乎没有任何共识。我正在为 Web 应用程序编写一个开源通用安装程序，我需要确认 PDO 连接是否成功。它需要测试 PDO 连接，然后它会写入实际的配置/初始化文件。文件写入部分工作正常，但我似乎无法具体验证 PDO 是否真正连接。如果表单为空，它表示已连接，如果表单中的某些信息正确，则表示已连接。如何明确指示 pdo 凭证是正确的？我会给你一个(精简版)我正在做的事情。

形式:

<H2>Please fill in your database credentials</H2>
<form class="form" action="" method="post">
  <label for="dbh">Database Host
  <input class="form-control" type="text" name="dbh"  value="<?php if (!empty($_POST['dbh'])){ print $_POST['dbh']; } ?>"></label><br><br>

  <label for="dbu">Database User
  <input class="form-control" type="text" name="dbu"  value="<?php if (!empty($_POST['dbu'])){ print $_POST['dbu']; } ?>"></label><br><br>

  <label for="dbp">Database Password
  <input class="form-control" type="text" name="dbp"  value="<?php if (!empty($_POST['dbp'])){ print $_POST['dbp']; } ?>"></label><br><br>

  <label for="dbn">Database Name
<input class="form-control" type="text" name="dbn"  value="<?php if (!empty($_POST['dbn'])){ print $_POST['dbn']; } ?>"></label><br><br>

PHP

<?php
if (!empty($_POST)) {
    $dbh=$_POST['dbh']; //db host
    $dbu=$_POST['dbu']; //db username
    $dbp=$_POST['dbp']; //db password
    $dbn=$_POST['dbn']; //database name

    //If Testing
    if (!empty($_POST['test'])) {
        $dsn = "mysql:host=$dbh;dbname=$dbn;charset=utf8";
        $opt = array(
            PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
            );
        $pdo = new PDO($dsn, $dbu, $dbp, $opt);
     }

    //todo:  If Submitted, a bunch more logic here
}
?>

Answer 1

如果有任何连接错误，一个PDOException对象将被抛出。

try {
    $pdo = new PDO($dsn, $dbu, $dbp, $opt);
} catch (PDOException $e) {
    // bad connection
}

要验证主机名、数据库名和登录凭据等数据是否正确，您必须强制用户不要将这些数据留空。事实上，完全有可能只与一台主机建立连接，那是因为mysql允许创建与任何用户名匹配的空白用户名(空字符串)的帐户。

此外，为了避免在 dsn 字符串中注入(inject)参数(例如，名为 foo;port=123 的数据库名称)，您至少应检查是否存在分号或 >NULL 连接选项中的字节(作为主机 e 数据库名称)。

例子

/**
 * Return a PDO object if the connection options are correct, and if the connection is established. False otherwhise.
 */
function test_mysql_connection($host, $dbname, $username, $password = null) {
    if (empty($host) || empty($dbname) || empty($username)) {
        // those parameters MUST NOT be empty
        throw new InvalidArgumentException('Host, database name and username are required.')
    }

    try {
        $pdo = new PDO(build_mysql_dsn_safely($host, $dbname), $username, $password);
        return $pdo;
    } catch (PDOException $e) {
        // bad connection
        return false;
    }
}

/**
 * See how is it parsed here: https://github.com/php/php-src/blob/71c19800258ee3a9548af9a5e64ab0a62d1b1d8e/ext/pdo/pdo.c#L207
 */
function build_mysql_dsn_safely($host, $dbname = null, $charset = null, $port = null)
{
    static $bad_chars = array(';', '=', "\0");

    $vars = array_filter(array(
        'host' => $host,
        'dbname' => $dbname,
        'charset' => $charset,
        'port' => $port,
    ));

    foreach($vars as $param => $data) {
        foreach ($bad_chars as $bad_char) {
            if (strpos($data, $bad_char) !== false) {
                throw new InvalidArgumentException(sprintf(
                    'Connection options "%s" contains an invalid value.', $param
                ));
            }
        }
    }

    return 'mysql:'.implode(';', array_map(function($optkey, $optval) {
        return $optkey.'='.$optval;
    }, array_keys($vars), $vars));
}

if($pdo = test_mysql_connection($_POST['dbh'], $_POST['dbu'], $_POST['dbn'], $_POST['dbp'])) {
    // connection established
}