javascript - php 代码在没有 JavaScript 验证的情况下从 html 字段发送空数据

Question

这听起来可能很奇怪，但有时当我加载 PHP 页面时，它会跳过验证并将 HTML 字段中的空字符串输入到 MYsql 数据库中。显示 mysql_affected_rows 之后的 javascript 警告框。

mysql_affected_rows() 有问题吗？

<?php
include ("db_connect.inc");

error_reporting(E_ALL ^ E_NOTICE);
error_reporting(E_ERROR | E_PARSE);
$userid= $_REQUEST['id'];
$pass = $_POST['password'];


$query = "UPDATE user SET password = '$pass' WHERE user_id='$userid'";
$result = mysql_query($query) or die(mysql_error());
if (mysql_affected_rows()==1)
{
echo ("<SCRIPT LANGUAGE='JavaScript'>
{
window.alert('Succesfully Updated');
window.location.href='index.php';}
</SCRIPT>");
}



?>

Javascript 验证

<script language="javascript">
  function validate()
  {
var str=true;
document.getElementById("msg1").innerHTML="";
document.getElementById("msg2").innerHTML="";
document.getElementById("msg3").innerHTML="";
if(document.frm.userid.value=='')
{ 
document.getElementById("msg1").innerHTML="Please Enter User ID";
str=false;
}

if(document.frm.password.value=='')
{
document.getElementById("msg2").innerHTML="Please Enter Password";
str=false;
}

if(document.frm.password.value!=document.frm.confirm_password.value)   
{
document.getElementById("msg3").innerHTML="Password and Confirm Password         does not match";
str=false;
}


return str;
}
</script>

HTML 格式

<form name="frm" action="" method="post" >
<table border="1" align="center">
<tr>
<td>User ID</td>
<td>
<input name="userid" type="text" value="<?php print $userid?>">
<div id="msg1" style="color:#FF0000"></div>
</td>
</tr>
<tr>
<td>Password</td>
<td>
<input name="password" type="password">
<div id="msg2" style="color:#FF0000"></div>
</td>
</tr>
<tr>
<td>Confirm Password</td>
<td>
<input name="confirm_password" type="password">
<div id="msg3" style="color:#FF0000"></div>
</td>
</tr>
<tr>
<td colspan="2" align="center">
  <input name="btnsubmit" type="submit" value="Submit" onclick="return validate();">
</td>
</tr>
</table>
</form>

Answer 1

您可能正在无条件地运行您的表单处理代码，例如

<?php
 .... process form stuff
?>
display form

您需要检查表单是否实际提交，例如

<?php
if ($_SERVER['REQUEST_METHOD'] == 'post') { 
   ... process form
}
?>
display form

请注意，您很容易受到 sql injection attacks 的攻击.