php - 试图避免 sql 注入(inject)攻击 - 导致数据未被插入

Question

我正在努力避免 SQL 注入(inject)攻击，感谢@Matthew Johnson，我快成功了(我认为)。

当我提交表单时，数据没有添加到我的表中。这段代码中有什么我遗漏的吗？

为什么数据没有插入到我的表中？

 <?php

 if (isset($_POST['submit'])) {

 include ('cc_connect.php');

 if (!$dbcon) {
die("Can not Connect: " . mysql_error());

}

mysql_select_db("cooperstown",$dbcon);

$first_name = isset($_POST['first_name']) ? $_POST['first_name'] : '';
$last_name = isset($_POST['last_name']) ? $_POST['last_name'] : '';
$street = isset($_POST['street']) ? $_POST['street'] : '';
$city = isset($_POST['city']) ? $_POST['city'] : '';
$state = isset($_POST['state']) ? $_POST['state'] : '';
$zip = isset($_POST['zip']) ? $_POST['zip'] : '';
$home_phone = isset($_POST['home_phone']) ? $_POST['home_phone'] : '';
$email = isset($_POST['email']) ? $_POST['email'] : '';
$birth_month = isset($_POST['birth_month']) ? $_POST['birth_month'] : '';
$birth_day = isset($_POST['birth_day']) ? $_POST['birth_day'] : '';
$birth_year = isset($_POST['birth_year']) ? $_POST['birth_year'] : '';
$grade = isset($_POST['grade']) ? $_POST['grade'] : '';
$school = isset($_POST['school']) ? $_POST['school'] : '';
$tryout_date = isset($_POST['tryout_date']) ? $_POST['tryout_date'] : '';
$guard1_first_name = isset($_POST['guard1_first_name']) ? $_POST['guard1_first_name'] : '';
$guard1_last_name = isset($_POST['guard1_last_name']) ? $_POST['guard1_last_name'] : '';
$guard1_email = isset($_POST['guard1_email']) ? $_POST['guard1_email'] : '';
$guard1_phone = isset($_POST['guard1_phone']) ? $_POST['guard1_phone'] : '';
$guard1_cell = isset($_POST['guard1_cell']) ? $_POST['guard1_cell'] : '';
$guard2_first_name = isset($_POST['guard2_first_name']) ? $_POST['guard2_first_name'] : '';
$guard2_last_name = isset($_POST['guard2_last_name']) ? $_POST['guard2_last_name'] : '';
$guard2_email = isset($_POST['guard2_email']) ? $_POST['guard2_email'] : '';
$guard2_phone = isset($_POST['guard2_phone']) ? $_POST['guard2_phone'] : '';
$guard2_cell = isset($_POST['guard2_cell']) ? $_POST['guard2_cell'] : '';


if ($first_name && $last_name && $street && $city && $state && $zip && $home_phone && $email && $birth_month && $birth_day && $birth_year && $grade && $school && $tryout_date && $guard1_first_name && $guard1_last_name && $guard1_email && $guard1_phone && $guard1_cell && $guard2_first_name && $guard2_last_name && $guard2_email && $guard2_phone && $guard2_cell) {

$stmt = $mysqli->prepare("INSERT INTO cobra_registration (first_name,last_name,street,city,state,zip,home_phone,email,birth_month,birth_day,birth_year,grade,school,tryout_date,guard1_first_name,guard1_last_name,guard1_email,guard1_phone,guard1_cell,guard2_first_name,guard2_last_name,guard2_email,guard2_phone,guard2_cell) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param("sssssiisiiiisssssiisssii", $first_name, $last_name, $street, $city, $state, $zip, $home_phone, $email, $birth_month, $birth_day, $birth_year, $grade, $school, $tryout_date, $guard1_first_name, $guard1_last_name, $guard1_email, $guard1_phone, $guard1_cell, $guard2_first_name, $guard2_last_name, $guard2_email, $guard2_phone, $guard2_cell)
$stmt->execute();
}


}

?> 

Answer 1

为了使用 mysqli 预处理语句，你必须使用 mysqli 连接到数据库:

$dbcon = new mysqli("server", "username", "password", "database");
if (!$dbcon) {
    die ("Cannot connect: " . mysqli_connect_error());
}