php - error_message 变量在表单提交时不显示字符串值

Question

我的数据库验证正在运行；如果已经有注册用户，“用户”表将不会更新。但是，我的 $error_message 变量不会显示错误消息字符串。这是我的代码:

HTML/PHP:

// Collect and validate user inputs
if($_SERVER["REQUEST_METHOD"] == "POST") {
  session_start();
  $forename = trim(filter_input(INPUT_POST,"user_forename",FILTER_SANITIZE_STRING));
  $surname = trim(filter_input(INPUT_POST,"user_surname",FILTER_SANITIZE_STRING));
  $gender = trim(filter_input(INPUT_POST,"user_gender",FILTER_SANITIZE_STRING));
  $email = trim(filter_input(INPUT_POST,"user_email",FILTER_SANITIZE_EMAIL));
  $password = trim(filter_input(INPUT_POST,"user_password"));
  $city = trim(filter_input(INPUT_POST,"user_city"));
  $team = trim(filter_input(INPUT_POST,"user_team",FILTER_SANITIZE_STRING));
  $bio = trim(filter_input(INPUT_POST,"user_bio",FILTER_SANITIZE_SPECIAL_CHARS));
  $human = trim(filter_input(INPUT_POST,"user_human",FILTER_SANITIZE_STRING));

  $userExist = mysql_query("SELECT * FROM User WHERE U_Email='$email'");

  if($forename == "" || $surname == "" || $email == "" || $password == ""
 || $city == "" || $team == "" || $bio == "" || $human == "") {
    $error_message = "Please fill in all form fields";
  }

  if (!isset($error_message) && !filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $error_message = "$email is a not a valid email address";
  }

  if (!isset($error_message) && (mysql_num_rows($userExist) > 0)) {
    $error_message = "$email is already taken!";
  }

  if(!isset($error_message)) {
      $sql = $db->query("INSERT INTO User (U_Forename, U_Surname, U_Gender, U_Email, U_Password, U_City, U_Team, U_Biography)
      VALUES('{$forename}', '{$surname}', '{$gender}', '{$email}', '{$password}', '{$city}', '{$team}', '{$bio}')");

      // header('Location: index.php');
  }
}

  <div class="wrapper">
          <h1>Register, it's free!</h1>
          <div>
            <?php
            if (isset($error_message)) {
              echo "<h2>".$error_message."</h2>";
            }
            ?>
          </div>

表单提交后不会显示任何错误消息。此外，我没有收到任何 PHP 错误，所以我不确定问题是什么。

任何建议都会很棒。

谢谢詹姆斯。

Answer 1

请记住mysqli和sql注入(inject)。

This extension was deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0. Instead, the MySQLi or PDO_MySQL extension should be used.

mysqli::real_escape_string -- mysqli_real_escape_string — Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection.

Note:: that if no connection is open, mysqli_real_escape_string() will return an empty string!

SQL injection is a technique where malicious users can inject SQL commands into an SQL statement, via web page input.

Injected SQL commands can alter SQL statement and compromise the security of a web application.

 <?php
    /* Attempt MySQL server connection. Assuming you are running MySQL
    server with default setting (user 'root' with no password) */
    $conn = mysqli_connect("localhost", "root", "", "demo");

    // Check connection
    if($conn === false){
        die("ERROR: Could not connect. " . mysqli_connect_error());
    }


  if(isset($_POST['user_forename']) && strlen(trim($_POST['user_forename']) > 0))
{

}
else
{
  $error_message = "Please enter forename";
}

 if(isset($_POST['user_surname']) && strlen(trim($_POST['user_surname']) > 0))
{
  $surname = trim($_POST['user_surname']);
}
else
{
  $error_message = "Please enter surname";
}

if(isset($_POST['user_gender']) && strlen(trim($_POST['user_gender']) > 0))
{
  $gender = trim($_POST['user_gender']);
}
else
{
  $error_message = "Please enter gender"; // if it is an input field.
}


if(isset($_POST['user_email']) && strlen(trim($_POST['user_email']) > 0))
{
  if(filter_var(trim($_POST['user_email']), FILTER_VALIDATE_EMAIL))
 {
   $mail = trim($_POST['user_gender']);
 }
else
{
   $error_message = "Please enter valid email"; 
}
}
else
{
  $error_message = "Please enter email"; 
}

 if(isset($_POST['user_password']) && strlen(trim($_POST['user_password']) > 0))
{
  $password = trim($_POST['user_password']);
}
else
{
  $error_message = "Please enter password";
}

 if(isset($_POST['user_city']) && strlen(trim($_POST['user_city']) > 0))
{
  $city = trim($_POST['user_city']);
}
else
{
  $error_message = "Please enter city";
}

 if(isset($_POST['user_bio']) && strlen(trim($_POST['user_bio']) > 0))
{
  $bio = trim($_POST['user_bio']);
}
else
{
  $error_message = "Please enter Biography";
}


    // Escape user inputs for security
    $forename = mysqli_real_escape_string($conn, $forename);
    $surname = mysqli_real_escape_string($conn, $surname);
    $gender = mysqli_real_escape_string($conn, $gender);
    $email = mysqli_real_escape_string($conn, $email);
    $password = mysqli_real_escape_string($conn, $password);
    $city = mysqli_real_escape_string($conn, $city);
    $team = mysqli_real_escape_string($conn, $team);
    $bio = mysqli_real_escape_string($conn, $bio);


// checking existing email

   if ($emailcheckquery = mysqli_query($conn, "SELECT * FROM User WHERE U_Email='$email'"))
{
  if(mysqli_num_rows($emailcheckquery) > 0)
  {
      $error_message = "email is already taken!";
  }    
}

if(!isset($error_message))
{
   // attempt insert query execution
    $insertsql = "INSERT INTO persons (U_Forename,U_Surname,U_Gender, U_Email,U_Password,U_City,U_Team,U_Biography) VALUES ('$forename', '$surname','$gender',$email,$password,$city,$team,$biography)";
    if(mysqli_query($conn, $sql)){
        echo "Records added successfully.";
    } else{
        echo "ERROR: Could not able to execute $sql. " . mysqli_error($link);
    }
}


    // close connection
    mysqli_close($conn);
    ?>






  <div class="wrapper">
     <h1>Register, it's free!</h1>
        <div>
                <?php
                if (isset($error_message)) {
                  echo "<h2>".$error_message."</h2>";
                }
                ?>
      </div>
   </div>