php - 引用 mysqli_connect.php 破坏 PHPExcel 下载程序

Question

我是一名新开发人员，最近为我的公司完成了一个简单的 PHP mySQL DBMS 的编码。现在我已经完成了它的工作，我想确保它的安全，实现我可以在网络上找到的所有安全最佳实践(例如:正则表达式，在网络目录之外包含 mysqli_connect.php与脚本内的连接字符串等)在我将其上线之前。我在这段代码之外编辑了一些个人信息，并将其替换为它的工作内容，但放在括号内。如果可能的话，我不想将其发布在网上。

通常，我只需引用 mysqli_connect.php 就可以使用我的数据库，如下所示:

require_once('..\mysqli_connect.php');

我的 DBMS 上的功能之一是“下载到 Excel”按钮。它工作完美，但只有当我直接在文件内部建立连接时。如果我尝试像上面的示例中那样编写连接，Excel 文件会显示以下错误消息:

Excel 无法打开文件“xyz.xlsx”，因为文件格式或扩展名无效。验证文件未损坏并且文件扩展名与文件格式匹配。

当我直接在 ExcelDownload.php 中写入连接时，Excel 文件可以正确下载。连接字符串如下所示:

$dbc = @mysqli_connect('[myhost]', '[myusername]', '[mypassword]', '[mydatabase]')

所以，基本上，间接引用连接会导致我的 Excel 下载出现错误，但我不知道为什么。如果我直接调用连接，效果很好。任何帮助将不胜感激。

再次感谢吉布里尔

顺便说一句，这是 ExcelDownload.php:

<?php
session_start();

//VERIFY LOGGED IN: Redirects user back to home page if they are not logged in or if they don't have the right privileges. Should be atop every page.
if(!isset($_SESSION['id']))
{header("Location: login.php");}

//CALLS PHPEXCEL: Creates connection to PHPExcel class library, and creates new instance of PHPExcel. 
//                From there it sets the attributes for some of PHPExcel's methods, to explain how we want the spreadsheet to be designed.

require_once 'Classes/PHPExcel.php';
$objPHPExcel = new PHPExcel();
$objPHPExcel->getActiveSheet()->setTitle('OpenOrders');
$objPHPExcel->getActiveSheet()->setCellValue('A1', '[my company]');

//CONFIRMATION: If Export to Excel button is pushed, then do this
if(isset($_POST["export_Excel"]))
{


    //DANGER!! UNSECURED DATABASE CONNECTION. BAD PRACTICE. CHANGE IN NEXT VERSION!
    //GENERATE QUERY: Connects to database -- Once connected, runs select * query and saves the outcome in $result
    $dbc = @mysqli_connect( '[myhost]', '[myusername]', '[mypassword]', '[mydb]')
    OR die ('Could not connect to MySQL ' . mysqli_connect_error()); 
    $sql = "[myquery]";
    $result = mysqli_query($dbc, $sql);

    //SET HEADING VALUE: Sets the values for the top row of the spreadsheet, which will be the headings.
    $objPHPExcel->getActiveSheet()->setCellValue('C3', 'OOPONO');
    $objPHPExcel->getActiveSheet()->setCellValue('D3', 'Order Status');
    $objPHPExcel->getActiveSheet()->setCellValue('E3', 'Order Comments');




    //ITERATOR: If there are values inside of $result, starting at row 4, insert values for OOPONO, order status, and comments until $results is totally intereated.
    if(mysqli_num_rows($result) > 0)
        {

            $rownumber = 4;

            while ($row = mysqli_fetch_array($result))
            {
                $row1 = 'C'.$rownumber;
                    $objPHPExcel->getActiveSheet()->setCellValue($row1, $row["OOPONO"]);
                $row1 = 'D'.$rownumber;
                    $objPHPExcel->getActiveSheet()->setCellValue($row1, $row["Order_Status"]);
                $row1 = 'E'.$rownumber;
                    $objPHPExcel->getActiveSheet()->setCellValue($row1, $row["Comments"]);


                $rownumber = $rownumber + 1;
            }                       
        }
}

//DOWNLOAD SETUP: Defines the different attributes of the Excel doc ranging from filename to extension. It also does the finishing touches of setting up the download.
header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
header('Content-Disposition: attachment;filename="OpenOrders.xlsx"');
header('Cache-Control: max-age=0');
$objWriter = PHPExcel_IOFactory::createWriter($objPHPExcel, 'Excel2007');
$objWriter->save('php://output');

?>

Answer 1

So again, basically, referencing the connection indirectly causes my Excel download to bug out and I don't know why. It works fine if I directly summon the connection.

不! 间接引用连接会导致错误，从而导致错误消息发送到您的显示器；然后 Excel 输出也会发送到您的显示器，从而使错误消息成为 Excel 数据流内容的一部分，从而将错误消息注入(inject)到文件中，从而导致文件损坏。

在文本编辑器中打开文件，您应该能够看到收到的实际错误消息