1

编辑：更新！让第一部分工作。但是，我不确定如何检查同一 IF() 语句中的其他变量。任何人都可以帮助我吗？单个 if 语句将拒绝名称与输入完全相同的类。但是，我还需要它拒绝相等的天数和时间。

        <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Register Diver</title>
<link rel="stylesheet" href="php_styles.css" type="text/css" />
<meta http-equiv="content-type"
content="text/html; charset=iso-8859-1" />
</head>
<body>
<h1>Aqua Don's Scuba School</h1>
<h2>Registration Confirmation</h2>
<?php
$DiverID = $_GET['diverID'];
if (empty($DiverID))
    exit("<p>You must enter a diver ID! Click your browser's Back button to return to the previous page.</p>");
$DBConnect = @mysqli_connect("localhost", "students", "password")
    Or die("<p>Unable to connect to the database server.</p>"
    . "<p>Error code " . mysqli_connect_errno()
    . ": " . mysqli_connect_error()) . "</p>";
$DBName = "scuba_school";
@mysqli_select_db($DBConnect, $DBName)
    Or die("<p>Unable to select the database.</p>"
    . "<p>Error code " . mysqli_errno($DBConnect)
    . ": " . mysqli_error($DBConnect)) . "</p>";

$TableName = "registration";
$SQLstring = "SELECT * FROM $TableName";
$QueryResult = @mysqli_query($DBConnect, $SQLstring);
if (!$QueryResult) {
    $SQLstring = "CREATE TABLE registration (diverID SMALLINT, class VARCHAR(40), days VARCHAR(40), time VARCHAR(40))";
    $QueryResult = @mysqli_query($DBConnect, $SQLstring)
        Or die("<p>Unable to create the registration table.</p>"
        . "<p>Error code " . mysqli_errno($DBConnect)
        . ": " . mysqli_error($DBConnect)) . "</p>";
    echo "<p>Successfully created the registration table.</p>";
}
?>

<?php
$Class = $_GET['class'];
$Days = $_GET['days'];
$Time = $_GET['time'];
$DiverID = $_GET['diverID'];

$DBConnect = mysqli_connect("localhost", "students", "password");
$DBName = "scuba_school";
@mysqli_select_db($DBConnect, $DBName)
    Or die("<p>Unable to select the database.</p>"
    . "<p>Error code " . mysqli_errno($DBConnect)
    . ": " . mysqli_error($DBConnect)) . "</p>";


$sqlString= "SELECT * FROM `registration` WHERE `diverID` = $DiverID AND `class` = '$Class' AND `days` = '$Days' AND `time` = '$Time'";
$QueryResult = mysqli_query($DBConnect, $sqlString) or die("MySQL error: " . mysqli_error($DBConnect) . "<hr>\nQuery: $QueryResult");  
$row = mysqli_fetch_assoc($QueryResult);

if ($row["class"] == $Class)
{

echo "<p>You are already registered for $Class</p>";
    }

    elseif($row["days"] == $Days && $row["time"] == $Time)
    {
        echo "<p>There is a conflict with $Days or $Time</p>";
        }
else
{
 $SQLstring = "INSERT INTO $TableName VALUES('$DiverID', '$Class', '$Days', '$Time')";
    $QueryResult = @mysqli_query($DBConnect, $SQLstring);
    echo "<p>You are registered for $Class on $Days, $Time. Click your browser's Back button to register for another course or review your schedule.</p>";
}


mysqli_close($DBConnect);
?>

</body>
</html>
4

3 回答 3

0

使用查询“找到所有有这些详细信息的人”，然后说“如果找到任何人 = 坏，否则 = 好。例如：

SELECT ID FROM $TableName WHERE DiverID = '$DiverId', class = '$class', days='$Days' LIMIT 1

然后你运行那个查询，如果它找到任何东西（if(count($results) > 0)...）然后你显示一个错误（或任何东西）如果它没有找到任何人，那么添加细节是安全的。

奖励： 作为旁注，请查看 PDO（ PHP 领域不再支持mysql_*函数）并确保在输入数据库查询之前过滤和清理输入（谷歌）

于 2012-11-15T23:42:33.703 回答
0

查询后您的情况不好

//change this
if ($row['class'] == "$Class")
{
    echo "<p>You are already registered for $Class</p>";
}

//to this
if(!empty($row))
{
    if ($row['class'] == "$Class")
        echo "<p>You are already registered for $Class</p>";
}
于 2012-11-15T23:46:18.497 回答
0

你的问题出在这里：

SELECT * FROM $TableName WHERE `diverID` = $DiverID

您正在数据库中查询与 匹配的所有记录diverID，而忽略class. 这意味着，例如，如果某个潜水员注册到不同的类别，则查询可能会或可能不会检索该记录。你想要类似的东西：

// this is for simplicity's sake only; please escape your input in your code!!

$sql = "SELECT * FROM $TableName WHERE `diverID` = $DiverID AND `class` = '$Class'"
$query = mysqli_query($sql);

if (mysqli_num_rows($query)) {
    // already registered
} else {
    // not registered, insert
}

话虽如此...

  1. 不要使用@（错误抑制）。关闭生产中的错误报告，但这（抑制错误）是可怕的。

  2. 不要让您的代码容易受到SQL 注入的影响。你甚至没有试图逃避任何东西，更糟糕的是，你正在使用$_GET，这也让你容易受到 CSRF 攻击。

  3. 不要即时创建表。在执行脚本之前，您应该已经准备好表结构。如果有的话，它们应该由安装脚本创建。

于 2012-11-15T23:47:03.737 回答