1

我已经开始编写一个带有登录名(用户/通行证/头像等)的基于社区的网站。所有这些变量都存储在 sql 服务器上,因此我可以访问它们以进行登录等。

我查看了所有谷歌,我的代码看起来很合理,并且我的电子邮件验证已发送。但是没有数据上传到我的sql数据库,所以不能创建用户。

我在下面包含了我的网站的代码,出于安全原因删除了连接信息。为什么我无法将数据写入我的数据库?任何帮助,将不胜感激。

注册.php

 <?php require('top.php'); ?>

 <div id="full">        
        <?php

        $form = " <form action='register.php' method='post'>

            <table cellspacing='10px'>
            <tr>

                <td></td>
                <td>Required Feilds <font color='red'>*</font></td>

            </tr>

            <tr>

                <td>First Name:</td>
                <td><input type='text' name='firstname' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Last Name:</td>
                <td><input type='text' name='lastname' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Username:</td>
                <td><input type='text' name='username' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Email:</td>
                <td><input type='text' name='email' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Password:</td>
                <td><input type='password' name='password' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Confirm Password:</td>
                <td><input type='password' name='repassword' class='textbox'><font color='red'>*</font></td>

            </tr>
            <tr>

                <td>Avatar:</td>
                <td><input type='file' name='avatar' > </td>

            </tr>
            <tr>

                <td>Website Address:</td>
                <td><input type='text' name='website' class='textbox'></td>

            </tr>
            <tr>

                <td>YouTube Username:</td>
                <td><input type='text' name='youtube' class='textbox'></td>

            </tr>
            <tr>

                <td>Bio:</td>
                <td><textarea name='bio' cols='35' rows='5' class='textbox'></textarea> </td>

            </tr>
            <tr>

                <td></td>
                <td><input type='submit' name='submitbtn' value='Register' class='button'></td>

            </tr>
            </table>

            </form>";

            if($_POST['submitbtn']) {

                $firstname = strip_tags($_POST['firstname']);
                $lastname = strip_tags($_POST['lastname']);
                $username = strip_tags($_POST['username']);
                $email = strip_tags($_POST['email']);
                $password = strip_tags($_POST['password']);
                $repassword = strip_tags($_POST['repassword']);
                $website = strip_tags($_POST['website']);
                $youtube = strip_tags($_POST['youtube']);
                $bio = strip_tags($_POST['bio']);


                $name = $_FILES['avatar']['name'];
                $type = $_FILES['avatar']['type'];
                $size = $_FILES['avatar']['size'];
                $tmpname = $_FILES['avatar']['tmp_name'];
                $ext = substr($name, strrpos($name, '.'));

                if ($firstname && $lastname && $username && $email && $password && $repassword) {

                    if ($password == $repassword){

                        if ( strstr($email, "@") && strstr($email, ".") && strlen($email) >= 6) {

                            require('connect.php');

                            $query = mysql_query("SELECT * FROM users WHERE username='$username'");
                            $numrows = mysql_num_rows($query);
                            if ($numrows == 0) {

                                $query = mysql_query("SELECT * FROM users WHERE email='$email'");
                                $numrows = mysql_num_rows($query);
                                if ($numrows == 0) {

                                    $pass = md5(md5($password));
                                    $date =date("F d, Y"); 

                                    if ($name) {

                                        move_uploaded_file($tmpname, "avatars/$username.$ext");
                                        $avatar = "$username.$ext";

                                    }
                                    else
                                        $avatar = "avatars/defavatar.png";

                                    $code = substr(md5(rand (1111111111, 99999999999999999)), 2, 25);

                                    mysql_query("INSERT INTO users VALUES       ('','$firstname','$lastname,'$username','$email','$pass','$avatatar','$bio','$website','$youtube','','0','$code','0','$date')");


                                    $webmaster = "email@email.com";
                                    $subject = "Activate Your Account";
                                    $headers = "From: a person <$webmaster>";
                                    $message = "Hello $firstname. Welcome to awebsite.com Below is a link for you to activate your account.\n\n Click Here to Activate Your Account: http://awebsite.netii.net/activate.php?code=$code";

                                    mail ($email, $subject, $message, $headers);

                                    echo "Thank You for registering. To access your account please activate your account by folowing the link sent to <b>$email</b>. If you do not see the email in your inbox, check your junk mail as it may have been filtered. If you are expeiriencing any problems please contact the site administrator at <a href='mailto:email@email.com'>email@email.com</a>";



                                }
                                else
                                    echo "That email is already taken. $form";

                            }
                            else
                                echo "That username is already taken. $form";


                        }
                        else
                            echo "You did not enter a valid email. $form";

                    }
                    else
                        echo "Your Passwords did not match. $form";

                }
                else
                    echo "You did not fill in all the required feilds. $form";
            }

            else 
                echo "$form";


         ?>
 </div>
<?php require('bottom.php');?>


</div>

</body>
</html>

激活.php

 <?php $title = "Activate Your Account"; ?>
    <?php require('top.php');?>

    <div id="full"> 
    <?php

        $getcode =$_GET['code'];

        $form = "<form action='activate.php' method='post'>
        <table>
        <tr>
            <td>Activate Code:</td>
            <td><input type='text' name='code' value='$getcode' size='30' </td>
        </tr>
        <tr>
            <td>Username:</td>
            <td><input type='text' name='username' </td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type='password' name='password' </td>
        </tr>
        <tr>
            <td></td>
            <td><input type='submit' name='submitbtn' value='Activate'</td>
        </tr>
        </table>
        </form>";

        if ($_POST['submitbtn']) {
            $code = strip_tags($_POST['code']);
            $username = strip_tags($_POST['username']);
            $password = strip_tags($_POST['password']);

            if ($code && $username && $password) {

                if (strlen($code) == 25) {

                    $pass = md5(md5($password));
                    require('connect.php');
                    $query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$pass'");
                    $numrows = mysql_num_rows($query);
                    if ($numrows == 1) {

                        $row = mysql_fetch_assoc($query);
                        $dbcode = $row['code'];

                        if ($code == $dbcode) {

                            mysql_query("UPDATE users SET active='1' WHERE username='$username'");

                            echo "Your account has been activated. You may now login. Click<a href='login.php'>here</a> to login.";

                        }
                        else
                            echo"Your activation code was incorrect. $form";

                    }
                    else
                        echo "Your username or password are invalid. $form";

                }
                else
                    echo "You have not supplied a valid code. $form";

            }
            else
                echo "You did not fill out the entire form. $form";
        }
        else
            echo "$form";

    ?>
</div>
<?php require('bottom.php');?>

连接.php

<?php 

$server = "";
$dbuser = "";
$dbpass = "";
$database = "";

mysql_connect($server, $dbuser, $dbpass) or die("Unable to connect to $server");
mysql_select_db($database) or die( "Unable to select $database" );

?>
4

2 回答 2

0

在 register.php 中,更改:

<form action='register.php' method='post'>

至:

<form action='register.php' method='post' enctype="multipart/form-data">

这是使用上传文件所必需的<input type="file" ...>

你不应该使用$pass = md5(md5($password));- 这只是一种容易破解的方法。而是查看crypt()- http://php.net/crypt

由于这是新代码,请考虑从mysql_*函数更改为mysqli_*或 PDO,因为 PHP 正在贬值mysql_*,这将节省您以后的时间。

于 2013-01-24T03:54:47.767 回答
0

您的代码中有拼写错误。

首先我们必须检查是否设置了提交请求,所以 => if($_POST['submitbtn']) 应该是,

if( isset($_POST['submitbtn']) ) {
     ...
}

更改代码并检查。

编辑

您可以重新格式化您的代码。检查所有不为空的变量,使用 mysql 转义而不是条形标签,并且不要对密码使用任何转义,仅使用 hash(md5)。

        if (isset($_POST['submitbtn'])) {
            $code     = mysql_real_escape_string($_POST['code']);
            $username = mysql_real_escape_string($_POST['username']);
            $password = md5($_POST['password']);
            $errors   = array();

            if (empty($code) || empty($username) || empty($password)) {
                $errors[] = "You did not fill out the entire form." . $form;
            } elseif(strlen($code) !== 25) {
                $errors[] = "You have not supplied a valid code." . $form;
            } else {
                // further code...
            }
        } else {
            echo $form;
        }
于 2013-01-24T03:18:42.883 回答