【问题标题】:How to add server side validation for a unique email如何为唯一电子邮件添加服务器端验证
【发布时间】:2016-03-15 14:58:54
【问题描述】:

我有一个非常简单的表单,用于获取电子邮件地址以发送简报。我试图弄清楚如何添加一些服务器端验证来检查输入的电子邮件地址是否已经在我的database 中。然后如果已经输入,则不允许表单提交,并抛出用户可以看到的错误。

我将如何检查并显示错误?

<form action="" method="POST" id="newsletter-form">
    <input type="email" id="footer-grid1-newsletter-input" placeholder="Your Email Address" pattern=".{3,}" required>
    <input type="submit" id="footer-grid1-newsletter-submit" name="submit" value='&nbsp'>
</form>


 $("#newsletter-form").on("submit", function (event) {
        event.preventDefault();

        var newsletter_email = $("#footer-grid1-newsletter-input").val();
        var targeted_popup_class = jQuery(this).attr('data-popup-open');

        $.ajax({ 
            url: "newsletterSend.php", 
            type: "POST",
            data: {
                "newsletter_email": newsletter_email
            },
            success: function (data) {
            //  console.log(data); // data object will return the response when status code is 200
                if (data == "Error!") {
                    alert("Unable to insert email!");
                    alert(data);
                } else {
                    $("#newsletter-form")[0].reset();
                    $('.newsletter-popup').fadeIn(350).delay(2000).fadeOut();
                }
            },
            error: function (xhr, textStatus, errorThrown) {
                alert(textStatus + " | " + errorThrown);
                //console.log("error"); //otherwise error if status code is other than 200.
            }
        });
    });

$newsletter_email = $_POST['newsletter_email'];

try {

    $con = mysqli_connect("localhost", "", "", "");

    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }
    $stmt = $con->prepare("INSERT INTO newsletter (email, subscribed) VALUES (?, NOW())");
        if ( false===$stmt ) {
            die('Newsletter email prepare() failed: ' . htmlspecialchars($con->error));
        }
    $stmt->bind_param('s', $newsletter_email);
        if ( false===$stmt ) {
            die('Newsletter email bind_param() failed: ' . htmlspecialchars($stmt->error));
        }
    $stmt->execute();
        if ( false===$stmt ) {
            die('Newsletter email execute() failed: ' . htmlspecialchars($stmt->error));
        }

【问题讨论】:

  • 只要加上return false;在您的 ajax 错误查询中,它不会提交
  • @AslanKaya 但是如何检查电子邮件是否已经输入?
  • 在尝试插入之前,您需要执行 SQL 检查电子邮件是否已经可用。下面的示例应该会有所帮助。
  • 试试下面的例子希望对你有帮助

标签: php jquery ajax forms validation


【解决方案1】:

下面的内容应该可以帮到你。

JS:

$(document).ready(function(){ //newly added  
    $('#footer-grid1-newsletter-submit').click(function() {      
        var emailVal = $('#footer-grid1-newsletter-input').val(); // assuming this is a input text field       
        $.post('checkemail.php', {'email' : emailVal}, function(data) {
            if(data=='exist'){
                $('#alert').html("<p> You are already subscribed to our website</p>");
                return false;
            }
            else {
                $('#newsletter-form').submit();
            }
        });     
    });

});

HTML:

<form action="" method="POST" id="newsletter-form">
    <input type="email" id="footer-grid1-newsletter-input" placeholder="Your Email Address" pattern=".{3,}" required>
    <input type="submit" id="footer-grid1-newsletter-submit" name="submit" value='&nbsp'>
</form>

PHP:

$con = mysqli_connect("localhost", "", "", "");

if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}


$sql = "SELECT email FROM newsletter WHERE email = '" .$_POST['email'] ."'";
$select = mysqli_query($con, $sql);
$row = mysqli_fetch_assoc($select);

if (mysqli_num_rows > 0) {
    echo "exist";
}
else {
    $stmt = $con->prepare("INSERT INTO newsletter (email, subscribed) VALUES (?, NOW())");  
}

【讨论】:

  • 这会使表单重新加载页面。
  • ...请不要回答SQL注入等漏洞。即使有一个例子。
  • 你可以试试 alert(data);看看输出是什么。返回假;应该禁用表单提交,除非 php 代码不发送结果存在这也是示例结果,您应该考虑自己的安全方法,例如 Duncan 提到的。您可以使用 mysql_real_escape_string() 来取消任何 SQL 注入。
猜你喜欢
  • 2017-02-07
  • 2016-06-04
  • 2021-08-22
  • 2011-01-21
  • 2021-07-09
  • 2014-05-23
  • 1970-01-01
  • 1970-01-01
  • 2016-11-19
相关资源
最近更新 更多