php - 在页面之间传递数据？

Question

我忘了如何正确地做到这一点。我基本上想要一个 PHP 页面将数据发送到数据库 (submitscore.php)，另一个从数据库中获取数据并将它们显示在表格中 (showscore.php):

提交分数.php:

if(isset($_POST['score']) && isset($_POST['playername']))
{
    $scorefromflash = mysql_real_escape_string($_POST['score']);
    $namefromflash = mysql_real_escape_string($_POST['playername']);


    $con = mysql_connect("servername","username","password");
    if (!$con)
    {
        die('Could not connect: ' . mysql_error());
    }

    mysql_select_db("testdb", $con);

    $sql = "INSERT INTO test (Name, Score) VALUES ('$namefromflash', '$scorefromflash')";

    header("./showscore.php");

    if (!mysql_query($sql,$con))
    {
        die('Error: ' . mysql_error());
    }

    mysql_close($con); 
}
?>

showscore.php

<?php

$con = mysql_connect("server","username","password");
if (!$con)
{
  die('Could not connect: ' . mysql_error());
}

mysql_select_db("testdb", $con);

echo ("Name: ".$namefromflash);
echo ("Score: ".$scorefromflash);

$result = mysql_query("SELECT * FROM test ORDER BY Score DESC");

echo "<table border='1'>
<tr>
<th>Name</th>
<th>Score</th>
</tr>";

while($row = mysql_fetch_array($result))
  {
  echo "<tr>";
  echo "<td>" . $row['Name'] . "</td>";
  echo "<td>" . $row['Score'] . "</td>";
  echo "</tr>";
  }
echo "</table>";

if (!mysql_query($sql,$con))
{
  die('Error: ' . mysql_error());
}

mysql_close($con); 

?>

我问是因为这样做会在 submitscore.php 上给出错误 Notice: Undefined index: score 和 Notice: Undefined index: playername页。

它没有向数据库中插入任何记录，也没有显示表格。

谢谢。

Answer 1

您的代码容易受到sql注入(inject)的攻击，您应该在将值插入数据库之前使用mysql_real_escape_string函数..

不需要

$scorefromflash = $_POST['score'];
$namefromflash = $_POST['playername'];

在显示分数页面...