2013-02-14 68 views
2

有人可以幫助我,我試圖提交一個3頁以上的表格。在每個使用會話中的3個文本區域字段開始回顯其他頁面的表單數據。會話表單數據跨多個頁面並插入到mysql?

那麼最後我所要做的就是回顯表單數據並將其插入到mysql表中的ptb_registrations中。

由於某種原因,雖然它不工作,即時通訊錯誤更新數據庫錯誤。我一直在這個工作幾個小時,很抱歉說,我無法弄清楚。請有人幫助我,讓我看看我可能會出錯的地方。

頁面1:

<?php 
session_start(); 
?> 

<form class="" method="post" action="register_p2.php"> 
<input type="text" id="first_name" name="first_name" placeholder="First Name" /> 
<input type="text" id="last_name" name="last_name" placeholder="Last Name" /> 
<input type="email" id="email" name="email" placeholder="Email" /> 
<input type="submit" value="Next >" /> 
</form> 

頁2:

<?php 
session_start(); 
// other php code here 

$_SESSION['first_name'] = $first_name; 
$_SESSION['last_name'] = $last_name; 
$_SESSION['email'] = $email; 
?> 
<form name="myForm" method="post" action="register_p3.php" onsubmit="return validateForm()" > 
<input type="text" id="date_of_birth" name="date_of_birth" placeholder="D.O.B 10/02/1990" /> 
<input type="text" id="number" name="number" placeholder="Mobile Number" /> 
<input type="text" id="confirm" name="confirm" placeholder="Are You a UK resident?" /> 
<input type="submit" value="Next >" /> 
</form> 

頁3:

<?php 
session_start(); 
// other php code here 

$_SESSION['first_name'] = $first_name; 
$_SESSION['last_name'] = $last_name; 
$_SESSION['email'] = $email; 
$_SESSION['dat_of_birth'] = $date_of_birth; 
$_SESSION['number'] = $number; 
?> 

<form class="" method="post" action="register_p4.php"> 
<input type="text" id="display_name" name="date_of_birth" placeholder="Display Name" /> 
<input type="password" id="password" name="password" placeholder="Password" /> 
<input type="password" id="password2" name="password2" placeholder="Password (Confirm)" /> 
<input type="submit" value="Next >" /> 
</form> 

頁4:(MySQL的功能)

<?php 
session_start(); 
// other php code here 

$_SESSION['first_name'] = $first_name; 
$_SESSION['last_name'] = $last_name; 
$_SESSION['email'] = $email; 
$_SESSION['dat_of_birth'] = $date_of_birth; 
$_SESSION['number'] = $number; 
$_SESSION['display_name'] = $display_name; 
$_SESSION['password'] = $password; 
?> 

<?php 
////// SEND TO DATABASE 


///////////////////////////////////////////////////////// 

// Database Constants 
define("DB_SERVER", "localhost"); 
define("DB_USER", "root"); 
define("DB_PASS", ""); 
define("DB_NAME", "database"); 

// 1. Create a database connection 
$connection = mysql_connect(DB_SERVER,DB_USER,DB_PASS); 
if (!$connection) { 
    die("Database connection failed: " . mysql_error()); 
} 

// 2. Select a database to use 
$db_select = mysql_select_db(DB_NAME,$connection); 
if (!$db_select) { 
    die("Database selection failed: " . mysql_error()); 
} 
////////////////////////////////////////////////////////////// 
$query="INSERT INTO ptb_registrations (ID, 
first_name, 
last_name, 
email, 
date_of_birth, 
contact_number, 
display_name, 
password 
) 
VALUES('NULL', 
'".$first_name."', 
'".$last_name."', 
'".$email."', 
'".$date_of_birth."', 
'".$number."', 
'".$display_name."', 
'".$password."' 
)"; 
mysql_query($query) or die ('Error updating database'); 
?> 
<?php 
function confirm_query($result_set) { 
       if (!$result_set) { 
        die("Database query failed: " . mysql_error()); 
       } 
     } 
function get_user_id() { 
    global $connection; 
    global $email; 
    $query = "SELECT * 
       FROM ptb_registrations 
       WHERE email = \"$email\" 
       "; 
     $user_id_set = mysql_query($query, $connection); 
     confirm_query($user_id_set); 
     return $user_id_set; 
     } 
?> 
<?php 
$user_id_set = get_user_id(); 
while ($user_id = mysql_fetch_array($user_id_set)) { 
    $cookie1 = "{$user_id["id"]}"; 
    setcookie("ptb_registrations", $cookie1, time()+3600); /* expire in 1 hour */ 

} 
?> 

<?php include ('includes/send_email/reg_email.php'); ?> 

<? ob_flush(); ?> 
+1

通過$ _POST ['First_Name'],您必須捕獲第二頁的值而不是將其作爲變量引用 – 2013-02-14 05:57:18

+0

您從哪裏學會了這樣做?這看起來像是充滿了[SQL注入漏洞](http://bobby-tables.com/),如果把它放在互聯網附近的任何地方都會使它非常危險。 – tadman 2013-02-14 05:59:38

+0

如果我不得不猜測數據庫錯誤 - 不要在插入中提供ID。取出ID和「null」。 – 2013-02-14 06:00:02

回答

0

page2.php你需要設置session如下。

因爲$first_name, etc..沒有聲明。

使page2.php

$_SESSION['first_name'] = $_POST['first_name']; 
$_SESSION['last_name'] = $_POST['last_name']; 
$_SESSION['email'] = $_POST['email'];

page3.php

$_SESSION['dat_of_birth'] = $_POST['date_of_birth']; 
$_SESSION['number'] = $_POST['number'];

page4.php

$_SESSION['display_name'] = $_POST['display_name']; 
$_SESSION['password'] = $_POST['password'];

在page4.php做一個更變量聲明。

$first_name = $_SESSION['first_name']; 
$last_name = $_SESSION['last_name']; 
$email = $_SESSION['email']; etc...

然後將其存儲在數據庫中。

+0

你看到'//其他php代碼在這裏嗎? – 2013-02-14 06:01:42

+0

好的,給我試一試 – 2013-02-14 06:02:07

+0

是的,但我沒有任何其他代碼去那裏 – 2013-02-14 06:03:12

0

這是不好的做法,這整個腳本,但我相信你的SQL錯誤是因爲你提供的ID爲空。 ID可能是一個整數,最有可能的自動增量。做到這一點,而不是:

$query="INSERT INTO ptb_registrations (
    first_name, 
    last_name, 
    email, 
    date_of_birth, 
    contact_number, 
    display_name, 
    password 
) 
VALUES(
    '".$first_name."', 
    '".$last_name."', 
    '".$email."', 
    '".$date_of_birth."', 
    '".$number."', 
    '".$display_name."', 
    '".$password."' 
)"; 
0

PGE 1:

<form class="" method="post" action="register_p2.php"> 
<input type="text" id="first_name" name="first_name" placeholder="First Name" /> 
<input type="text" id="last_name" name="last_name" placeholder="Last Name" /> 
<input type="email" id="email" name="email" placeholder="Email" /> 
<input type="submit" value="Next >" /> 
</form> 

無需在session_start這裏

的Page2:

<?php 
session_start(); 
// other php code here 

$_SESSION['first_name'] = $_POST['first_name']; 
$_SESSION['last_name'] = $_POST['last_name']; 
$_SESSION['email'] = $_POST['email']; 
?> 
<form name="myForm" method="post" action="register_p3.php" onsubmit="return validateForm()" > 
<input type="text" id="date_of_birth" name="date_of_birth" placeholder="D.O.B 10/02/1990" /> 
<input type="text" id="number" name="number" placeholder="Mobile Number" /> 
<input type="text" id="confirm" name="confirm" placeholder="Are You a UK resident?" /> 
<input type="submit" value="Next >" /> 
</form> 

增加$ _ POST

第3頁:

<?php 
session_start(); 
// other php code here 


$_SESSION['dat_of_birth'] = $_POST['date_of_birth']; 
$_SESSION['number'] = $_POST['number']; 
?> 

<form class="" method="post" action="register_p4.php"> 
<input type="text" id="display_name" name="date_of_birth" placeholder="Display Name" /> 
<input type="password" id="password" name="password" placeholder="Password" /> 
<input type="password" id="password2" name="password2" placeholder="Password (Confirm)" /> 
<input type="submit" value="Next >" /> 
</form> 

增加$ _ POST $_SESSION['first_name'] = $_POST['first_name'];

無需在第3頁再次添加此部分:

$_SESSION['first_name'] = $first_name; 
$_SESSION['last_name'] = $last_name; 
$_SESSION['email'] = $email; 

第4頁:

<?php 
session_start(); 
// other php code here 

$first_name = $_SESSION['first_name']; 
$last_name = $_SESSION['last_name']; 
$email  = $_SESSION['email']; 
$date_of_birth = $_SESSION['dat_of_birth'] ; 
$number =$_SESSION['number']; 
$display_name = $_SESSION['display_name']; 
$password = $_SESSION['password']; 
?> 

<?php 
////// SEND TO DATABASE 


///////////////////////////////////////////////////////// 

// Database Constants 
define("DB_SERVER", "localhost"); 
define("DB_USER", "root"); 
define("DB_PASS", ""); 
define("DB_NAME", "database"); 

// 1. Create a database connection 
$connection = mysql_connect(DB_SERVER,DB_USER,DB_PASS); 
if (!$connection) { 
    die("Database connection failed: " . mysql_error()); 
} 

// 2. Select a database to use 
$db_select = mysql_select_db(DB_NAME,$connection); 
if (!$db_select) { 
    die("Database selection failed: " . mysql_error()); 
} 
////////////////////////////////////////////////////////////// 
$query="INSERT INTO ptb_registrations (ID, 
first_name, 
last_name, 
email, 
date_of_birth, 
contact_number, 
display_name, 
password 
) 
VALUES('NULL', 
'".mysql_real_escape_string($first_name)."', 
'".mysql_real_escape_string($last_name)."', 
'".mysql_real_escape_string($email)."', 
'".mysql_real_escape_string($date_of_birth)."', 
'".mysql_real_escape_string($number)."', 
'".mysql_real_escape_string($display_name)."', 
'".mysql_real_escape_string($password)."' 
)"; 
mysql_query($query) or die ('Error updating database'); 
?> 
<?php 
function confirm_query($result_set) { 
       if (!$result_set) { 
        die("Database query failed: " . mysql_error()); 
       } 
     } 
function get_user_id() { 
    global $connection; 
    global $email; 
    $query = "SELECT * 
       FROM ptb_registrations 
       WHERE email = \"$email\" 
       "; 
     $user_id_set = mysql_query($query, $connection); 
     confirm_query($user_id_set); 
     return $user_id_set; 
     } 
?> 
<?php 
$user_id_set = get_user_id(); 
while ($user_id = mysql_fetch_array($user_id_set)) { 
    $cookie1 = "{$user_id["id"]}"; 
    setcookie("ptb_registrations", $cookie1, time()+3600); /* expire in 1 hour */ 

} 
?> 

<?php include ('includes/send_email/reg_email.php'); ?> 

<? ob_flush(); ?> 

分配會話變量:

$first_name = $_SESSION['first_name']; 

mysql_ *功能已被棄用使用mysqli_ *或PDO

你的代碼很容易受到mysql_injection:使用ATLEAST mysql_real_escape_string

+0

我做了你說的一切,它仍然沒有把它放到我的MySQL表,但我沒有收到任何錯誤,它只是說感謝註冊,並沒有插入值:( – 2013-02-14 06:21:52

+0

'echo $ query;'在第4頁的mysql_query($ query)或die('Error updating database');'之前添加此行,並查看您的查詢將如何進行。請把它粘貼在這裏。 – 2013-02-14 06:26:00

+0

INSERT INTO ptb_registrations(ID,first_name,last_name,email,display_name,date_of_birth,contact_number,password,account_type)VALUES('NULL','','','','asdasd','','','adad ','Member')更新數據庫時出錯 – 2013-02-14 06:35:44

2

please can someone help me and show me where i might be going wrong.

你的代碼本身就是可怕的。 因爲

1)你混合會話和數據庫的責任

2)您對查詢使用mysql_query(),你不要指望一個結果集。對於INSERT, UPDATE, DELETE查詢應使用mysql_unbuffered_query()

3)您不使用mysql_real_escape_string()讓你容易受到SQL注入

4)使用的程序代碼和全局狀態

5)使用逃脫值棄用mysql_*功能,而不是PDOMySQLi

6)使用字符串連接而不是sprintf(),在這裏:

) 
VALUES(
    '".$first_name."', 
    '".$last_name."', 
    '".$email."', 
    '".$date_of_birth."', 
    '".$number."', 
    '".$display_name."', 
    '".$password."' 

7)您不驗證$_SESSION$_POST中的任何內容。如果你設置了變量而它們不存在呢?

8)您查詢驗證是錯誤的,在這裏:confirm_query($result_set) {..

我最好就此打住。

因此,不是用這種方式編碼,而是真正分開責任。

對於會話,它應該是這樣的:

文件session.php

function seesion_init(){ 
    if (session_id() == ''){ 
    return session_start(); 
    } else { 
    return true; 
    } 
} 

function session_set(array $values){ 
    foreach($values as $key => $val){ 
    $_SESSION[$key] = $val; 
    } 
} 

/** 
* It will give you a confidence that you get an existing value 
* @param string $key 
*/ 
function session_get($key){ 
    if (isset($_SESSION[$key])){ 
     return $_SESSION[$key]; 
    } else { 
     throw new RuntimeException(sprintf('Accessed to non-existing session variable %s', $key)); 
    } 
} 

文件:dbconnection.php

<?php 

define('HOST', '...'); 
define('USER', '...'); 
... 


function connect(){ 

    if (! mysql_connect(...)){ 
     die('...'); 
    } 

    if (! mysql_select_db('DB_NAME_HERE')){ 
     die('...'); 
    } 
} 


function query($query){ 
    return mysql_query($query); //<- Should only be used for SELECT queries 
} 


function ub_query($query){ 
    return mysql_unbuffered_query($query); // <- Should only be used for INSERT, DELETE, UPDATE queries 
} 

function fetch($result){ 
    return mysql_fetch_assoc($result); 
} 

文件:users.php

require_once('dbconnection.php'); 

connect(); 

/** 
* Returns user id by his username 
* 
* @return array on success 
*   FALSE if email does not exists 
*/ 
function get_user_id_by_email($email) { 

    $query = sprintf("SELECT `id` FROM `ptb_registrations` WHERE `email` = '$email' LIMIT 1", mysql_real_escape_string($email)); 

    $result = ub_query($query); 

    if ($result){ 
     return fetch($result); 
    } else { 
     return false; 
    } 

} 

等。這裏的概念是分離每個腳本的責任,然後使用你需要的「部分」。

回到原來的問題

要插入一個值到表?然後首先驗證此值。問題是你不這樣做。而已。