php - 使用 else if 处理现有电子邮件检查数据库时出错

Question

我被一些代码困住了。我对此还很陌生。

如果 else 语句 ($uidcheck) 返回 false，则应执行 elseif 语句 ($emailcheck)。请参阅下面的代码。

$username = $_POST['username'];
$email = $_POST['email'];
$pwd = $_POST['pwd'];

if (empty($username)) {
    header("Location: ../signup.php?error=empty");
    exit();
}
if (empty($email)) {
    header("Location: ../signup.php?error=empty");
    exit();
}
if (empty($pwd)) {
    header("Location: ../signup.php?error=empty");
    exit();

} else {
        $sql = "SELECT username FROM user WHERE username='$username'";
        $result = mysqli_query($conn, $sql);
        $uidcheck = mysqli_num_rows($result);
        if ($uidcheck > 0) {
            header("Location: ../signup.php?error=username");
            exit();

    } elseif ($uidcheck < 0) {

        $sql = "SELECT email FROM user WHERE email='$email'";
        $result = mysqli_query($conn, $sql);
        $emailcheck = mysqli_num_rows($result);
        if ($emailcheck > 0) {
            header("Location: ../signup.php?error=email");
            exit();

        } else {

            $sql = "INSERT INTO user (username, email, pwd) 
            VALUES ('$username', '$email', '$pwd')";
            $result = mysqli_query($conn, $sql);

            header("Location: ../index.php");
        }

    }
}

当电子邮件地址已存在于数据库中时，它应该退出并向 header 添加参数。

提前致谢!

斯文

Answer 1

您的代码可能会达到目的。但这还不足以读取/调试。

if( !isset($_POST["username"]) || !isset($_POST["email"]) || !isset($_POST["pwd"]) || empty($_POST["username"]) || empty($_POST["email"]) || empty($_POST["pwd"]) )
{
    header("Location: ../signup.php?error=empty");
    exit();
}
$sql = "SELECT username FROM user WHERE username='".mysqli_real_escape_string($username)."'";
$result = mysqli_query($conn, $sql);
$uidcheck = mysqli_num_rows($result);
if ($uidcheck > 0) 
{
    header("Location: ../signup.php?error=username");
    exit();
}
else 
{
    $sql = "SELECT email FROM user WHERE email='".mysqli_real_escape_string($email)."'";
    $result = mysqli_query($conn, $sql);
    $emailcheck = mysqli_num_rows($result);
    if ($emailcheck > 0) {
        header("Location: ../signup.php?error=email");
        exit();
    }
    else {
        $sql = "INSERT INTO user (username, email, pwd) 
            VALUES ('$username', '$email', '$pwd')";
        $result = mysqli_query($conn, $sql);
        header("Location: ../index.php");
    }
}

这是我的建议:

• 始终使用 isset() 函数检查变量是否在作用域中声明。如果在POST请求中未提交“username”或“email或“pwd”的值，您的代码将抛出>致命异常并且渲染在那里停止......
• 不要将用户提交的值直接放入 SQL 查询中....这将使您的 Web 应用程序<强>易受影响 SQL Injection Attack .