php - 在 PHP 中验证输入表单

Question

我试图在使用此代码插入数据库之前验证我的表单，但我一直在打印'您错过了一个值' .我需要你的帮助来找出问题所在。

谢谢

<?php
 $username   = mysql_real_escape_string($_POST['username']);
 $pword      = mysql_real_escape_string($_POST['passwd']);
 $fname      = mysql_real_escape_string($_POST['firstname']);
 $lname      = mysql_real_escape_string($_POST['lastname']);
 $email      = mysql_real_escape_string($_POST['email']);
 $telephone  = mysql_real_escape_string($_POST['telephone']);
 $ad1        = mysql_real_escape_string($_POST['ad1']);
 $ad2        = mysql_real_escape_string($_POST['street']);
 $ad3        = mysql_real_escape_string($_POST['town']);
 $pcode      = mysql_real_escape_string($_POST['pcode']);


 if( $username == " " || $pword == " " || $fname == " " || $lname == " " || $email == " ")

    echo 'You missed a value';  
    exit();

    $con = mysql_connect("localhost","root","");
    if (!$con)
    {
      die('Could not connect: ' . mysql_error());
    }

  mysql_select_db("people", $con);

//$description = mysql_real_escape_string($_POST[description]);
    $pword = md5($pword);
    $sql="INSERT INTO members (username, pword, fname, lname, email, telephone, ad1, ad2, ad3, pcode)
VALUES
('$username','$pword','$fname', '$lname', '$email','$telephone','$ad1','$ad2','$ad3','$pcode')";


  if (!mysql_query($sql,$con)){
   die('Error: ' . mysql_error());
   }
   echo "1 record added";

 mysql_close($con)
?> 

Answer 1

您应该验证原始 POST 值，而不是 mysql_real_escape_string 值。此外，您正在比较 (空格)而不是空字符串并分配它们而不是比较它们。