0

我在使用 PHP 和 MYSQL 时遇到问题。我有一个 HTML 表单，提交时运行以下 PHP 脚本。问题是以下 PHP 代码将数据插入数据库两次。我认为这与以下 PHP 而不是数据库有关：

<?php

$first_name = $_POST['firstname'];
$last_name = $_POST['lastname'];
$display_name = $_POST['displayname'];
$email = $_POST['email'];
$password = $_POST['password'];
$add_line1 = $_POST['addline1'];
$add_line2 = $_POST['addline2'];
$city = $_POST['city'];
$county = $_POST['county'];
$postcode = $_POST['postcode'];

$sql = "INSERT INTO members (memberID, 
memberPassword, 
memberFirstName, 
memberLastName,
memberAddressLine1, 
memberAddressLine2, 
memberCity,
memberCounty, 
memberPostcode, 
memberDisplayName) 
VALUES ('$email', 
'$password', '$first_name', '$last_name',
 '$add_line1', '$add_line2','$city',
 '$county', '$postcode', '$display_name')";

if (!mysqli_query($conn,$sql))
{
     die('Error: ' . mysqli_error($conn));
}
mysqli_query($conn,$sql);
echo 'Guest Added';
mysqli_close($conn);

?>
4

2 回答 2

7 
if (!mysqli_query($conn,$sql))
{
     die('Error: ' . mysqli_error($conn));
}
mysqli_query($conn,$sql);

You have mysqli_query($conn,$sql); in your code twice. Once in the if(), and once outside. Each of these will insert into your database.

The point to note here is that the mysqli_query inside the if is evaluated - that is, it is run and the if statement executes on the result of the function call. Thus, you do not need to call it again.

于 2013-03-18T22:28:29.730 回答
2

Tushar 指出了双 mysqli 查询，他是对的，除此之外，现在的代码会导致安全问题，因为它允许 sql 注入......

请修改您的代码如下：

 $first_name   = mysqli_escape_string($conn, $_POST['firstname']);
 $last_name    = mysqli_escape_string($conn, $_POST['lastname']);
 $display_name = mysqli_escape_string($conn, $_POST['displayname']);
 $email        = mysqli_escape_string($conn, $_POST['email']);
 $password     = mysqli_escape_string($conn, $_POST['password']);
 $add_line1    = mysqli_escape_string($conn, $_POST['addline1']);
 $add_line2    = mysqli_escape_string($conn, $_POST['addline2']);
 $city         = mysqli_escape_string($conn, $_POST['city']);
 $county       = mysqli_escape_string($conn, $_POST['county']);
 $postcode     = mysqli_escape_string($conn, $_POST['postcode']);
于 2013-03-18T22:38:09.690 回答