【发布时间】:2016-02-29 13:22:00
【问题描述】:
我制作了一个用于安卓设备的成功注册/登录脚本。我对 PHP 很陌生,所以请多多包涵。
<?php
require "init.php";
header('Content-type: application/json');
$email = $_POST['email'];
$user_name = $_POST['user_name'];
$user_pass = $_POST['user_pass'];
$msg = "Congratulations. You are now registered to the most amazing app
ever!";
$passwordEncrypted = sha1($user_pass);
if($email && $user_name && $user_pass){
$sql_query = "select * from user_info WHERE email ='".mysqli_real_escape_string($con, $email)."' or user_name
='".mysqli_real_escape_string($con, $user_name)."'";
$result = mysqli_query($con, $sql_query);
$results = mysqli_num_rows($result);
if ($results){
$don = array('result' =>"fail","message"=>"Email or username exists.");
}else{
$sql_query = "insert into user_info values('$email','$user_name','$passwordEncrypted');";
if(mysqli_query($con,$sql_query)){
$don = array('result' =>"success","message"=>"Successfully registered!Well done");
//mail($email,"Well done",$msg);
}
}
}else if(!$email || (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL))){
$don = array('result' =>"fail","message"=>"Please enter a valid email");
}else if(!$user_name){
$don = array('result' =>"fail","message"=>"Please enter your username");
}else if(!$user_pass){
$don = array('result' =>"fail","message"=>"Please enter a password");
}
}
echo json_encode($don);
?>
使用上述代码,电子邮件未经过验证,即使用户输入的是 theo 而不是“theo@gmail.com”,也会进入数据库
【问题讨论】:
-
好吧,在插入电子邮件之前,我没有看到任何错误处理来检查电子邮件是否真的是电子邮件......?
-
您就在那儿,先生。卡汉给出了解决方案:)。
标签: php validation email