-1

在更新我的注册表单验证 PHP 时,我遇到了一个似乎无法修复的错误:

列计数与第 1 行的值计数不匹配

我一遍又一遍地查看代码,我似乎看不出它有什么问题。PHP 语法和格式检查器似乎都说代码没问题。我知道这个错误经常出现,但我看不到我的代码与收到相同错误的其他人的代码之间的相似性。

<?
include "./includes/config.inc.php";

include $include_path."cc.inc.php";
include $include_path."banemails.inc.php";




$is_pre_registration = (isset($_REQUEST['pre_registration']) && $_REQUEST['pre_registration'] == "1") ? "1" : "";

$TIME = mktime(date("H")+$SETTINGS['timecorrection'],date("i"),date("s"),date("m"), date("d"),date("Y"));
$NOW = date("YmdHis",$TIME);
$NOWB = date("YmdHis",$TIME);
// --
if (!isset($_POST['auction_id']) && !isset($_GET['auction_id'])) {
    $auction_id = $_SESSION["CURRENT_ITEM"];
} else {
    $_SESSION["CURRENT_ITEM"]=intval($auction_id);
}
if (empty($_POST['action'])) {
    $action = "first";
}
#// Retrieve users signup settings
$query = "SELECT * FROM BPLA_usersettings";
$res_s = @mysql_query($query);
if(!$res_s){
    MySQLError($query);
    exit;
}else{
    $REQUESTED_FIELDS = unserialize(mysql_result($res_s,0,"requested_fields"));
    $MANDATORY_FIELDS = unserialize(mysql_result($res_s,0,"mandatory_fields"));
}



if ($_POST['action'] == "first") {

    if (empty($_POST['accounttype']) && $SETTINGS['accounttype'] == 'sellerbuyer') {
        $TPL_err = 1;
        $TPL_errmsg = $MSG_25_0137;
    } elseif (empty($_POST['TPL_nick'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5030;
    } elseif (empty($_POST['TPL_password'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5031;
    } elseif (empty($_POST['TPL_repeat_password'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5032;
    } elseif (empty($_POST['TPL_email'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5033;
    } else {
        if (strlen($_POST['TPL_nick']) < 6) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_107;
        } else if (strlen ($_POST['TPL_password']) < 6) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_108;
        } else if ($_POST['TPL_password'] != $_POST['TPL_repeat_password']) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_109;
        } else if (strlen($_POST['TPL_email']) < 5) { // Primitive mail check
        $TPL_err = 1;
        $TPL_errmsg = $ERR_110;
        } elseif (!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+([\.][a-z0-9-]+)+$", $_POST['TPL_email'])) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_008;
        } elseif(BannedEmail($_POST['TPL_email'],$BANNEDDOMAINS)){
            $TPL_err = 1;
            $TPL_errmsg = $MSG_30_0054;
        } else {
            $sql = "SELECT nick FROM BPLA_users WHERE nick=\"" . AddSlashes ($_POST['TPL_nick']) . "\"";
            $res = mysql_query ($sql);
            if (mysql_num_rows($res) == 0) {
                $id = md5(uniqid(rand()));
                $id = eregi_replace("[a-f]", "", $id);

                $TPL_id_hidden = $id;
                $TPL_nick_hidden = $_POST['TPL_nick'];
                $TPL_password_hidden = $_POST['TPL_password'];
                $TPL_email_hidden = $_POST['TPL_email'];
            } else {
                $TPL_err = 1;
                $TPL_errmsg = $ERR_111; // Selected user already exists
            }

            $sql = "SELECT email FROM BPLA_users WHERE email=\"" . AddSlashes ($_POST['TPL_email']) . "\"";
            $res = mysql_query ($sql);
            if (mysql_num_rows($res) == 0) {
                $id = md5(uniqid(rand()));
                // $id = eregi_replace("[a-f]","",$id);
                $TPL_id_hidden = $id;
                $TPL_nick_hidden = $_POST['TPL_nick'];
                $TPL_password_hidden = $_POST['TPL_password'];
                $TPL_email_hidden = $_POST['TPL_email'];
            } else {
                $TPL_err = 1;
                $TPL_errmsg = $ERR_115; // E-mail already used
            }

            if ($TPL_err == 0) {
                $TODAY = $NOWB;
                # // #################################################################
                # // Users suspended field
                # // VALUES:
                # //        9 - sign up fee due
                # //         8 - no fee due, waiting for user's confirmation
                # //            1 - suspended by the administrator via admin utility
                # //
                $SUSPENDED = 8;
                if($SETTINGS['accounttype'] == 'sellerbuyer') {
                    $selected_accounttype = $_POST['accounttype'];
                } else {
                    $selected_accounttype = 'unique';
                }

                if($is_pre_registration != ""){
                    $user_pre_registration = "1";
                }else{
                    $user_pre_registration = "0";
                    //, is_pre_registration
                    //, ".intval($user_pre_registration)."
                }
                if($BPLowbidAuction_TESTMODE == 'yes') {
                     include "header.php";
                    echo "<strong>".$ERR_9999."</strong>";
                        include phpa_include("template_register.html");
                    exit();
                } else {
                $sql = "INSERT INTO BPLA_users (id,
                        nick, password, nletter,email, reg_date,
                        rate_sum,  rate_num,suspended,accounttype)
                          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
                      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                        . (int)($_POST['TPL_nletter']) . "\", \""
                        . AddSlashes ($_POST['TPL_email']) . "\",
                      '$TODAY',
                      0,
                      0,
                      '$DATE',
                      '$SUSPENDED',
                      ENCODE(\"$MD5_PREFIX\"))";
                $res = mysql_query ($sql);
                if ($res == 0) {
                    $TPL_err = 1;
                    $TPL_errmsg = mysql_error (); //"Error updating users data";
                } else {
                    $TPL_id_hidden=mysql_insert_id();
                    # // ===========================================================
                    # // Added by Gian for IP banning
                    # // Store user IP address in the database
                    # // ===========================================================
                    $query = "INSERT INTO BPLA_usersips VALUES(
                              NULL,
                              ".intval($TPL_id_hidden).",
                              '".$_SERVER["REMOTE_ADDR"]."',
                              'first','accept')";
                    $res___ = @mysql_query($query);
                    if (!$res___) {
                        MySQLError($query);
                        exit;
                    }
                    # // ===========================================================
                    /**
                    * Update column users in table BPLA_counters
                    */
                    $query = "UPDATE BPLA_counters SET inactiveusers=inactiveusers+1";
                    $counteruser = mysql_query($query);
                    if (!$counteruser) {
                        MySQLError($query);
                        exit;
                    }
                    # // ===========================================================
                    /**
                    * Set up the language of this user in table BPLA_userslanguage
                    */
                    $language = $SETTINGS['defaultlanguage'];
                    $_SESSION['language'] = $language;
                    $userlanguage = mysql_query("INSERT INTO BPLA_userslanguage VALUES(
                                         '".$TPL_id_hidden."',
                                         '$language')");
                    if (!$userlanguage) {
                        MySQLError($query);
                        exit;
                    }
                    # // Send confirmation e-mail message depending on the peyment settings
                    #// and the signup confirmation settings
                    //if ($SETTINGS['signupfee'] != 1) {
 //                       if(($SETTINGS['usignupconfirmation'] == 'y' && $SETTINGS['accounttype'] == 'unique') || 
 //                          (($SETTINGS['sbsignupconfirmation'] == 's' || $SETTINGS['sbsignupconfirmation'] == 'sb') && $_POST['accounttype'] == 'seller') ||
 //                          (($SETTINGS['sbsignupconfirmation'] == 'b' || $SETTINGS['sbsignupconfirmation'] == 'sb') && $_POST['accounttype'] == 'buyer')) {
                            #Suspend user
                    $query = "UPDATE BPLA_users SET suspended=0,reg_date=reg_date WHERE id=$TPL_id_hidden";
                    $RES__ = @mysql_query($query);
                    if (!$RES__) {
                        echo "KLSDHD";
                        //MySQLError($query);
                        exit;
                    } else {
                        # Send e-mail to the user and the admin                    
                        include $include_path."user_confirmation_needapproval.inc.php";                        
                    }
//                        }else{
//                            include $include_path."user_confirmation.inc.php";
 //                       }
                    //}
                }
                }
            } // if($TPL_err == 0)
        }
    }
}


include "header.php";
if (($action == "first" && count($_POST) == 0) || ($_POST['action'] == "first" && $TPL_err)) {
    include phpa_include("template_register.html");
}

if ($_POST['action'] == "first" && !$TPL_err) {
    # //
    include phpa_include("template_registered_php.html");
}
include "footer.php";
$TPL_err = 0;
$TPL_errmsg = "";
?>

改变:

       $sql = "INSERT INTO BPLA_users (id,
                nick, password, nletter,email, reg_date,
                rate_sum,  rate_num,suspended,accounttype)
                  VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
              . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                . (int)($_POST['TPL_nletter']) . "\", \""
                . AddSlashes ($_POST['TPL_email']) . "\",
              '$TODAY',
              0,
              0,
              '$DATE',
              '$SUSPENDED',
              ENCODE(\"$CC\",\"$MD5_PREFIX\"),
              '$_POST[TPL_exp_month]','$_POST[TPL_exp_year]','$_POST[TPL_card_owner]','$_POST[TPL_card_zip]',1)"

到:

$sql = "INSERT INTO BPLA_users (id,
                        nick, password, nletter,email, reg_date,
                        rate_sum,  rate_num,suspended,accounttype)
                          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
                      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                        . (int)($_POST['TPL_nletter']) . "\", \""
                        . AddSlashes ($_POST['TPL_email']) . "\",
                      '$TODAY',
                      0,
                      0,
                      '$DATE',
                      '$SUSPENDED',
                      ENCODE(\"$MD5_PREFIX\"))";

现在收到错误:您的 SQL 语法有错误;检查与您的 MySQL 服务器版本相对应的手册,以在第 10 行的 '))' 附近使用正确的语法

4

2 回答 2

1

INSERT当查询中指定的列数与提供的值数不匹配时,会发生此错误。例如:

INSERT INTO mytable (col1, col2) VALUES ('val1');

在以下行中,您列出了 10 列(id、nick、password、nletter、email、reg_date、rate_sum、rate_num、suspended、accounttype),但有 16 个值。

$sql = "INSERT INTO BPLA_users (id,
        nick, password, nletter,email, reg_date,
        rate_sum,  rate_num,suspended,accounttype)
          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
        . (int)($_POST['TPL_nletter']) . "\", \""
        . AddSlashes ($_POST['TPL_email']) . "\",
      '$TODAY',
      0,
      0,
      '$DATE',
      '$SUSPENDED',
      ENCODE(\"$CC\",\"$MD5_PREFIX\"),
      '$_POST[TPL_exp_month]','$_POST[TPL_exp_year]','$_POST[TPL_card_owner]','$_POST[TPL_card_zip]',1)";

您需要列出与以下值对应的列名:

$_POST[TPL_exp_month]
$_POST[TPL_exp_year]
$_POST[TPL_card_owner]
$_POST[TPL_card_zip]
1

非常重要:您应该使用准备好的语句来防止 SQL 注入。这是一种非常危险且可悲的是非常常见的攻击。见https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

于 2012-11-18T18:09:32.313 回答
1

您的INSERT INTO BPLA_users ...;查询有 10 个列名,但有 16 个值。由于数字不匹配,您会收到错误消息。

于 2012-11-18T18:11:59.553 回答