在我的 PHP 验证方面需要帮助

Question

我正在尝试执行表单注册验证，但我不知道我是否正确。

首先，我为表单中的每个空白字段存储一条错误消息。 之后，如果我的字段不为空，我想验证用户名字段（来自无效字符）、密码和电子邮件

问题是当我删除 die();在我的用户名验证条件行中，它确实向我显示了错误消息和成功消息，并且在我的数据库中插入了无效的用户名。

我很确定问题出在我的 if($numrows==0) 条件下，但我不知道为什么。

<?php
session_start();
$con=mysql_connect('localhost','root','') or die(mysql_error());
mysql_select_db('user_registration') or die("cannot select DB");


if(isset($_POST["submit"])){

    $arrErrors = array();
    unset($_SESSION['errors']);

    if($_POST['user'] == ''){
        $arrErrors['user_not_completed'] = "Username is not completed!";
        $_SESSION['errors'] = $arrErrors;
        header("Location: register.php");
    }

    if($_POST['pass'] == ''){
        $arrErrors['pass_not_completed'] = "Password is not completed!";
        $_SESSION['errors'] = $arrErrors;
        header("Location: register.php");
    }

    if($_POST['email'] == ''){
        $arrErrors['email_not_completed'] = "Email is not completed!";
        $_SESSION['errors'] = $arrErrors;
        header("Location: register.php");
    }

    if(!empty($_POST['user']) && !empty($_POST['pass']) && !empty($_POST['email'])) {
        $user=$_POST['user'];
        $pass=$_POST['pass'];
        $email=$_POST['email'];

            if(!preg_match("/^[a-zA-Z'-]+$/",$user)) {
                $arrErrors['invalid_user'] = "Username is invalid!";
                $_SESSION['errors'] = $arrErrors;
                header("Location: register.php");
                die();
            } 

        $query=mysql_query("SELECT * FROM users WHERE username='".$user."'");
        $numrows=mysql_num_rows($query);


        if($numrows==0){
            $sql="INSERT INTO users(username,password, email) VALUES('$user','$pass', '$email')";
            $result=mysql_query($sql);


            if($result){
                $arrErrors['succes'] = 'Account successfuly created!';
                $_SESSION['errors'] = $arrErrors;
                header("Location: register.php");
            } 

        } else {
            $arrErrors['already_exists'] = 'That username already exists!';
            $_SESSION['errors'] = $arrErrors;
            header("Location: register.php");
        }

} 

}
?>

Answer 1

我建议你这样做：

<?php
    //FIRST I WOULD CHECK IF SESSION EXIST BEFORE STARTING IT:
    if (session_status() == PHP_SESSION_NONE  || session_id() == '') {
        session_start();
    }
    //NEXT I'D USE PDO AS MY DATABASE ABSTRACTION LAYER: IT HAS A LOT OF ADVANTAGES, REALLY:
    //DATABASE CONNECTION CONFIGURATION:
    defined("HOST")     or define("HOST",   "localhost");           //REPLACE WITH YOUR DB-HOST
    defined("DBASE")    or define("DBASE",  "user_registration");   //REPLACE WITH YOUR DB NAME
    defined("USER")     or define("USER",   "root");                //REPLACE WITH YOUR DB-USER
    defined("PASS")     or define("PASS",   "");                    //REPLACE WITH YOUR DB-PASS

    if(isset($_POST["submit"])){
        //THEN CLEAN UP THE SUBMITTED DATA TO AVOID POSSIBLE ATTACKS...
        $user       = isset($_POST['user'])     ? htmlspecialchars(trim($_POST['user']))    : null;     //PROTECT AGAINST ATTACKS
        $pass       = isset($_POST['pass'])     ? htmlspecialchars(trim($_POST['pass']))    : null;     //PROTECT AGAINST ATTACKS
        $email      = isset($_POST['email'])    ? htmlspecialchars(trim($_POST['email']))   : null;     //PROTECT AGAINST ATTACKS
        $passRX     = '#(^[a-zA-z0-9\-\+_\}\{\(\)])([\w\.\-\\:\;\+\(\)\/\}\{\(\)\ ])*\w*$#';
        $userRX     = '#(^[a-zA-z])([\w\.\-\(\)\ ])*\w*$#';
        $arrErrors  = array();

        unset($_SESSION['errors']);

        //CHECK IF USERNAME CONFORMS TO THE CUSTOM USERNAME REG-EXP...
        if(!preg_match($userRX, $user)){
            $arrErrors['user_not_completed'] = "Username is either not completed or is invalid!";
            //SAVE ERRORS TO SESSION
            $_SESSION['errors'] = $arrErrors;
            //REDIRECT BACK TO REGISTER PAGE
            header("Location: register.php");
            exit;
        }

        //CHECK IF PASSWORD CONFORMS TO THE CUSTOM PASSWORD REG-EXP...
        if(!preg_match($passRX, $pass)){
            $arrErrors['pass_not_completed'] = "Password is not completed!";
            //SAVE ERRORS TO SESSION
            $_SESSION['errors'] = $arrErrors;
            //REDIRECT BACK TO REGISTER PAGE
            header("Location: register.php");
            exit;
        }

        //CHECK IF E-MAIL CONFORMS TO THE STANDARD E-MAIL FORMAT USING BUILT-FUNCTIONS...
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $arrErrors['email_not_completed'] = "Email is not completed!";
            //SAVE ERRORS TO SESSION
            $_SESSION['errors'] = $arrErrors;
            //REDIRECT BACK TO REGISTER PAGE
            header("Location: register.php");
            exit;
        }

        //BECAUSE WE HAVE SANITIZED VERSIONS OF OUR $user, $pass & $email VARIABLES
        //WE CAN JUST  USE THEM DIRECTLY HERE:
        if($user && $pass && $email) {
            //HERE WE BEGIN THE PDO HIGH-LEVEL MAGIC... ;-)
            try {
                $dbh        = new PDO('mysql:host='.HOST.';dbname='. DBASE,USER,PASS);
                $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                $stmt       = $dbh->prepare("SELECT * FROM users WHERE username = :user");
                $stmt->execute(['user' => $user]);
                $objUser    = $stmt->fetch(PDO::FETCH_OBJ);

                //THIS USER DOES NOT ALREADY EXIST SO WE GO AHEAD AND CREATE A CORRESPONDING RECORD IN THE DB TABLE
                if(!$objUser){
                    $stmt   = $dbh->prepare("INSERT INTO users (username, password, email) VALUES(:user, :pass, :email)");
                    $stmt->bindParam(':user',   $user);
                    $stmt->bindParam(':pass',   $pass);
                    $stmt->bindParam(':email',  $email);
                    $insertStatus   = $stmt->execute();

                    if($insertStatus){
                        $arrErrors['succes']    = 'Account successfuly created!';
                        $_SESSION['errors']     = $arrErrors;
                        header("Location: register.php");
                        exit;
                    }
                }else {
                    $arrErrors['already_exists']    = 'That username already exists!';
                    $_SESSION['errors']             = $arrErrors;
                    header("Location: register.php");
                    exit;
                }


                //GARBAGE COLLECTION
                $dbh        = null;
            }catch(PDOException $e){
                //YOU HANDLE YOUR EXCEPTIONS HERE IN YOUR OWN UNIQUE MANNER...
                echo $e->getMessage();
            }
        }

    }
?>

希望这会有所帮助...