如果使用准备的语句，我仍然应该进行输入验证吗？ [重复]

Question

当我最初问这个问题时，它类似于：检查是否已经使用已准备好的语句查看数据库中是否已经在数据库中这帮助我解决了自己的情况。查看我们的两个代码后，我注意到我正在验证用户输入，而另一个帖子没有提及它。 so，在使用准备好的语句时验证用户输入仍然好吗？

我的原始帖子：我已经尝试了几天，并且对代码有问题。我正在尝试TP Learn PHP和MySQL/Mariadb，并正在研究允许管理员和用户的多用户登录系统。

到目前为止，我有以下工作：

使用者可以注册如果已经注册，则可以登录和注销（根据用户级别将索引页 Aadministrator被指示基于管理级别的“管理”主页

Administrator可以从管理区域创建一个新用户（用户级别无访问）

注册页面和管理员创建用户页面之间的仅限差异是，admin创建用户页面允许分配用户或管理员的角色（在注册页面上没有任何选项）

我遇到的问题是，我想添加一张检查以防止用户名的重复（新注册的用户或管理员创建的用户如果已经命名，则无法创建新用户）。我尝试插入支票查看，但即使已经存在用户名，它仍然会添加用户。

我的管理员创建用户代码：
<?php include('../functions.php') ?> if (!isAdmin()) { $_SESSION['msg'] = "You must log in first"; header('location: ../login.php'); } <!DOCTYPE html> <html> <head> <title>Registration system PHP and MySQL - Create user</title> <link rel="stylesheet" type="text/css" href="../style.css"> <style> .header { background: #003366; } button[name=register_btn] { background: #003366; } </style> </head> <body> <div class="header"> <h2>Admin - create user</h2> </div> <form method="post" action="create_user.php"> <?php echo display_error(); ?> <div class="input-group"> <label>Username</label> <input type="text" name="username" value="<?php echo $username; ?>"> </div> <div class="input-group"> <label>Email</label> <input type="email" name="email" value="<?php echo $email; ?>"> </div> <div class="input-group"> <label>User type</label> <select name="user_type" id="user_type" > <option value=""></option> <option value="admin">Admin</option> <option value="user">User</option> </select> </div> <div class="input-group"> <label>Password</label> <input type="password" name="password_1"> </div> <div class="input-group"> <label>Confirm password</label> <input type="password" name="password_2"> </div> <div class="input-group"> <button type="submit" class="btn" name="register_btn"> + Create user</button> </div> </form> </body> </html>
**Here is Register page:** <?php include('functions.php') ?> <!DOCTYPE html> <html> <head> <title>Registration system PHP and MySQL</title> <link rel="stylesheet" href="style.css"> </head> <body> <div class="header"> <h2>Register</h2> </div> <form method="post" action="register.php"> <?php echo display_error(); ?> <div class="input-group"> <label for="username" class="col-md-3 control-label">User Name*</label> <div class="col-md-9"> <input type="username" class="form-control" name="username" placeholder="User Name" required> </div> </div> <div class="input-group"> <label for="email" class="col-md-3 control-label">Email*</label> <div class="col-md-9"> <input type="email" class="form-control" name="email" placeholder="Email" required> </div> </div> <div class="input-group"> <label for="password" class="col-md-3 control-label">Password</label> <div class="col-md-9"> <input type="password" class="form-control" name="password_1" placeholder="Password" required> </div> </div> <div class="input-group"> <label for="password" class="col-md-3 control-label">Confirm password</label> <div class="col-md-9"> <input type="password" class="form-control" name="password_2" placeholder="Password" required> </div> </div> <div class="input-group"> <button type="submit" class="btn" name="register_btn">Register</button> </div> <p> Already a member? <a href="login.php">Sign in</a> </p> </form> </body> </html>

    <?php 
session_start();

// connect to database
$db = mysqli_connect('removed variables to connect to database this works');

// variable declaration
$username = "";
$email    = "";
$errors   = array(); 

// call the register() function if register_btn is clicked
if (isset($_POST['register_btn'])) {
    register();
}

function register(){
    // call these variables with the global keyword to make them available in function
    global $db, $errors, $username, $email;

    // receive all input values from the form. Call the e() function
    // defined below to escape form values
    $username    =  e($_POST['username']);
    $email       =  e($_POST['email']);
    $password_1  =  e($_POST['password_1']);
    $password_2  =  e($_POST['password_2']);
    
    $sql= "SELECT * FROM users WHERE username = '$username'";

$result=mysqli_query($sql);

if(mysqli_num_rows($result)!=0)
       {
        echo"name already exists";
}

    // form validation: ensure that the form is correctly filled
    if (empty($username)) { 
        array_push($errors, "Username is required"); 
    }
    if (empty($email)) { 
        array_push($errors, "Email is required"); 
    }
    if (empty($password_1)) { 
        array_push($errors, "Password is required"); 
    }
    if ($password_1 != $password_2) {
        array_push($errors, "The two passwords do not match");
    }

    // register user if there are no errors in the form
    if (count($errors) == 0) {
        $password = hash('sha256', $password_1);//encrypt the password before saving in the database
        // excecute insert query 

        if (isset($_POST['user_type'])) {
            $user_type = e($_POST['user_type']);
            $query = "INSERT INTO users (username, email, user_type, password) 
                      VALUES('$username', '$email', '$user_type', '$password')";
            mysqli_query($db, $query);
            $_SESSION['success']  = "New user successfully created!!";
            header('location: home.php');
        }else{
            $query = "INSERT INTO users (username, email, user_type, password) 
                      VALUES('$username', '$email', 'user', '$password')";
            mysqli_query($db, $query);

            // get id of the created user
            $logged_in_user_id = mysqli_insert_id($db);

            $_SESSION['user'] = getUserById($logged_in_user_id); // put logged in user in session
            $_SESSION['success']  = "You are now logged in";
            header('location: index.php');              
        }
    }

}
            // ge

// return user array from their id
function getUserById($id){
    global $db;
    $query = "SELECT * FROM users WHERE id=" . $id;
    $result = mysqli_query($db, $query);

    $user = mysqli_fetch_assoc($result);
    return $user;
}

// escape string
function e($val){
    global $db;
    return mysqli_real_escape_string($db, trim($val));
}

function display_error() {
    global $errors;

    if (count($errors) > 0){
        echo '<div class="error">';
            foreach ($errors as $error){
                echo $error .'<br>';
            }
        echo '</div>';
    }
}

function isLoggedIn()
{
    if (isset($_SESSION['user'])) {
        return true;
    }else{
        return false;
    }
}

// log user out if logout button clicked
if (isset($_GET['logout'])) {
    session_destroy();
    unset($_SESSION['user']);
    header("location: login.php");
}

// call the login() function if register_btn is clicked
if (isset($_POST['login_btn'])) {
    login();
}

// LOGIN USER
function login(){
    global $db, $username, $errors;

    // grap form values
    $username = e($_POST['username']);
    $password = e($_POST['password']);

    // make sure form is filled properly
    if (empty($username)) {
        array_push($errors, "Username is required");
    }
    if (empty($password)) {
        array_push($errors, "Password is required");
    }

    // attempt login if no errors on form
    if (count($errors) == 0) {
        $password = hash(sha256, $password);

        $query = "SELECT * FROM users WHERE username='$username' AND password='$password' LIMIT 1";
        $results = mysqli_query($db, $query);

        if (mysqli_num_rows($results) == 1) { // user found
            // check if user is admin or user
            $logged_in_user = mysqli_fetch_assoc($results);
            if ($logged_in_user['user_type'] == 'admin') {

                $_SESSION['user'] = $logged_in_user;
                $_SESSION['success']  = "You are now logged in";
                header('location: admin/home.php');       
            }else{
                $_SESSION['user'] = $logged_in_user;
                $_SESSION['success']  = "You are now logged in";

                header('location: index.php');
            }
        }else {
            array_push($errors, "Wrong username/password combination");
        }
    }
}

function isAdmin()
{
    if (isset($_SESSION['user']) && $_SESSION['user']['user_type'] == 'admin' ) {
        return true;
    }else{
        return false;
    }
}

提前感谢

popblem在

mysqli_query

函数中，此函数至少需要2个参数，第一个函数是指向数据库的链接，因此您的代码应该是：

$connection = mysqli_connect("localhost","db_user","db_password","db_name");

/* your code */

$result=mysqli_query($connection, $sql);

如果使用准备的语句，我仍然应该进行输入验证吗？ [重复]

问题描述投票：0回答：0

最新问题

如果使用准备的语句，我仍然应该进行输入验证吗？ [重复]

问题描述 投票：0回答：0

最新问题

问题描述投票：0回答：0