1

我无法将我在 Php 中的注册表与验证码集成在一起。我已经尝试将它们与我非常有限的编码知识集成在一起，但是当输入错误的验证码时，它会显示“不正确的验证码”，但不幸的是，它也会在我的 Mysql Db 上输入用户，而无需先验证验证码。

所有相关代码如下图，请大家帮忙，谢谢！

1.Registration.php



    <div class="form-title">Sign Up</div>
    <div class="form-sub-title">It's free and anyone can join</div>

        <form method="post" action="check.php" enctype="multipart/form-data">

        <table width="864" align="center" cellpadding = "15">



            <tr>
                <td>FirstName:</td>
                <td><input type="text" name="FirstName" maxlength="10" required="" ></td>
              .....................................................................................................................................................................................................

         <td>&nbsp;</td>

</td>
  </tr> </td>
  <td>
 <?php
session_start();
echo '<form action="check.php" method="post">';
$rand_int1 = substr(mt_rand(),0,2);
$rand_int2 = substr(mt_rand(),0,1);
$rand_int3 = substr(mt_rand(),0,1);
$captcha_answer = $rand_int1 + $rand_int2 - $rand_int3;
$_SESSION['captcha_answer'] = $captcha_answer;
echo 'What is '.$rand_int1.' + '.$rand_int2.' - '.$rand_int3.'?<br>
<input type="text" name="captcha">
<td><input type="submit" value="Submit" name="registration" class="greenButton"/><img id="loading" src="img/ajax-loader.gif" alt="working.." /></td>
</form>';
?>
</td>
</tr>



 2. Check.php


   <?php
session_start();
$captcha = $_POST['captcha'];
$captcha_answer = $_SESSION['captcha_answer'];

if($captcha != $captcha_answer) {
    echo 'Captcha is incorrect!';
}
else {
    echo 'Captcha is correct, congratulations! :)';
}
?>




<?php



if(isset($_POST['registration']))
{
    require "connection.php";
    $FirstName = strip_tags($_POST['FirstName']);
    $LastName = strip_tags($_POST['LastName']);
    $Msisdn = $_POST['Msisdn'];

    $month = $_POST['month'];
    $day = $_POST['day'];
    $year = $_POST['year'];

    $date = $year . "-" . $month . "-" . $day;
    $dob = date('y-m-d', strtotime($date));




$Gender = $_POST['Gender'];
$Faith = $_POST['Faith'];
$City = $_POST['City'];
$MarritalStatus = $_POST['MarritalStatus'];
$Profession =$_POST['Profession'];
$Country = $_POST['Country'];








$query="insert into users set FirstName='".$FirstName."',LastName='".$LastName
        ."',Msisdn='".$Msisdn."',dob='".$dob."',Gender='".$Gender."',Faith='".$Faith."',City='".$City."',MarritalStatus='".$MarritalStatus."',Profession='".$Profession."',Country='".$Country."'";


mysql_query($query)or  die("".mysql_error());   



    echo "Successful Registration!";



        }
?>
4

2 回答 2

0

这里的代码不检查验证码是否成功。做那个改变

if(isset($_POST['registration']))

至

if(isset($_POST['registration']) && $captcha == $captcha_answer)

于 2013-09-10T13:34:51.247 回答
0

验证码应该阻止机器人成功提交表单。x1 + x2 - x3对于任何自动表单提交来说都太容易了。

为了解决您的任务，在 if 子句中if(isset($_POST['registration']))您还需要检查验证码是否成功，将其更改为：

if (isset($_POST['registration']) && $captcha === $captcha_answer)

您也不应该使用mysql_函数，因为它们很快就会在较新的 PHP 版本中被关闭。

您的代码看起来也很容易成为黑客的目标（SQL 注入）。您应该验证$_POST变量，而不仅仅是将它们放入一个简单的查询中。

就像我输入';DROP TABLE users;--名字一样。

于 2013-09-10T13:33:12.177 回答