有人能告诉我我的代码有什么问题吗？ PHP，MySQL，HTML

Question

有人可以向我解释我的注册页面有什么问题吗？数据库连接没问题，但是当我检查表时，没有任何新用户。

我的HTML

<form action="register.php" method="post"> 
<input type="text" name="username" placeholder="username"><br/> 
<input type="password" name="password" placeholder="password"><br/> 
<input type="text" name="email" placeholder="E-mail"><br/> 
<input type="submit" value="Submit"> 
</form> 

我的PHP

<?php 

$user_name = "mah user name"; 
$password = "mah password"; 
$database = "Peoples"; 
$server = "mysql6.000webhost.com"; 

$db_handle = mysql_connect($server, $user_name, $password); 
$db_found = mysql_select_db($database, $db_handle); 
$username = test_input($_POST["username"]); 
$email = test_input($_POST["email"]); 
$password = $_POST["password"]; 
$registered=0; 

if ($db_found) { 

$SQL = "INSERT INTO users (username,password,email,registered) VALUES ($username, $password, $email,$registered)"; 

$result = mysql_query($SQL); 

mysql_close($db_handle); 

print "Records added to the database"; 

} 
else { 

print "Database NOT Found "; 
mysql_close($db_handle); 

} 

function test_input($data) 
{ 
$data = trim($data); 
$data = stripslashes($data); 
$data = htmlspecialchars($data); 
return $data; 
} 

Sorrry如果有太多的代码。 ？>

Answer 1

我以前有这些问题，一般需要一点点sussing像MySQL错误不会显示为PHP错误 - 所以不会被打印到这一页。就我个人而言，我会使用MySQLi与PHP，因为它对几件事情有更大的支持，如果你想要具体的东西，就做一个谷歌搜索，有时候SQL可能只需要在包含字符的查询中包装表和数据库名称（左边的1个键键盘上的窗户）

尝试使用下面的代码来代替：

<?php 
    // Init databse connection 
    $db_handle = new mysqli("mysql6.000webhost.com","username","password","Peoples") or die("Database connection error"); 

    // check connection 
    if ($db_handle->connect_errno) { 
     printf("Connect failed: %s\n", $mysqli->connect_error); 
     exit(); 
    } 

    // Strip function for query string 
    function test_input($data){ 
     $data = trim($data); 
     $data = stripslashes($data); 
     $data = htmlspecialchars($data); 
     return $data; 
    } 

    $username = test_input($_POST["username"]); 
    $email = test_input($_POST["email"]); 
    $password = $_POST["password"]; 
    $registered=0; 

    // Try insert query, sometimes wrapping the table name in ` characters solves the issue - only use on database and table names not values 
    if($result = $db_handle->query("INSERT INTO `users` (username,password,email,registered) VALUES ('$username','$password','$email','$registered');")) { 
     echo 'Records added to the database'; 
     // free result set 
     $result->close(); 
    } 
    else { 
     echo 'Database NOT Found'; 
    } 

    $db_handle->close(); 
?> 

而且这是很好的做法，取消设置（$ VAR）;但说实话，如果你期望的流量很小，这没什么好担心的。

如果你拿在数据库中的用户数据，保留原始密码可能得罪人，你真的不应该这样做在事件的数据会从你偷来的，然后你为什么有人解释给所有用户用他们喜欢使用的用户名和密码来运行他们登录的所有内容。

你应该使用：

$password = hash('sha256',$_POST['password']); 

并存储该字符串，或任何其他你喜欢的散列变种 - SHA256恰好是一个我喜欢用。当用户尝试登录时，应再次提供他们提供的密码，并根据存储在数据库中的散列值进行检查。

最后一些用户可能更喜欢你使用SSL加密，为您的域名，如果他们在网上输入密码，再次只是做了谷歌搜索，如果你不熟悉，更多的问题，我会回答，尽我所能:)

Answer 2

尝试将函数test_data放在值之前。

<?php 

    $user_name = "mah user name"; 
    $password = "mah password"; 
    $database = "Peoples"; 
    $server = "mysql6.000webhost.com"; 

    $db_handle = mysql_connect($server, $user_name, $password); 
    $db_found = mysql_select_db($database, $db_handle); 

    function test_input($data){ 
    $data = trim($data); 
    $data = stripslashes($data); 
    $data = htmlspecialchars($data); 
    return $data; 
    } 

    $username = test_input($_POST["username"]); 
    $email = test_input($_POST["email"]); 
    $password = $_POST["password"]; 
    $registered=0; 


    /* or you could use PHP built in filters 

    $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); 
    $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); 
    $email  = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); 
    */ 


    $SQL = "INSERT INTO users (username,password,email,registered) VALUES ('$username','$password','$email','$registered')"; 

    $result = mysql_query($SQL) or die(mysql_error()); 

    if($result) { 
    echo 'Registration was successfull.'; 
    } 
    else { 
    echo 'Registration was not successfull'; 

    } 

mysql_close($db_handle); 
?> 

更多关于内置过滤器PHP Filters