使用 PHP 验证针对 MYSQL 数据库的表单字段

Question

我正在尝试做我认为是一项简单的任务，但结果却相当困难。我要做的就是提供一个 1 字段表单，允许用户输入一个唯一的 id 并点击提交。如果唯一 id 与数据库中的其中一个 id 匹配，那么它们将被定向到页面。如果 id 不匹配，我希望它告诉“Id 不匹配，再试一次”或类似的东西。

我看过无数涉及登录表单的教程，但这比我需要的要多一些，每次我尝试将其简化为我需要的内容时，它都不起作用。我尝试了很多不同的代码。这是我目前拥有的。

更新代码：

<form name="enterclient" method="post">
<label for="clientid">Enter your client id</label><br />
<input name="clientid" id="clientid"><br /><br />
<input type="submit" value="Submit" name="submit" id="submit">
</form>

<?php global $current_user;
  get_currentuserinfo();
$host = 'myhost';
$username = 'myuser';
$pass = 'mypass';
$database = 'mydb';
$link = mysqli_connect($host,$username,$pass, $database);

$clientid = $_REQUEST['clientid'];

if ($link) {

    if(isset($_POST['submit'])) {   
    if (empty ($clientid)) {
    //if username field is empty echo below statement
        echo "you must enter your unique username <br />";
    }
    $query = "SELECT * FROM wp_locations WHERE client = '". mysqli_real_escape_string($link,$clientid) ."'" ;
    $result = mysqli_query($link, $query) or die("Unable to query");
    $option = "";
    while($row=mysqli_fetch_array($result, MYSQLI_BOTH)) {
    $option .= "<option value='{$row['client']}'>{$row['client']}</option>";
    }
}

else {   
}//close else

if ($result) {
print $option;
    echo "query successful";
    header('location: http://www.google.com');
}
else {
    echo"query fail";
}


}//end of initial if $db_found

else {
    print "Database NOT Found ";
}

// disconnect from the database
mysql_close();?>

更新的输出： 当我到达初始页面时，它仍然显示“查询失败”，我猜这是因为 $clientid 还没有值。

当我在框中输入任何内容时，它都会返回“查询成功”。我希望它仅在输入与数据库值之一匹配时才返回成功。

如果我输入一个我知道与数据库值匹配的值，它会给我一个该数据库值的列表，无论它存在多少次，并说查询成功。

请务必注意，重定向似乎永远不会起作用。

Answer 1

缩进后看看你的代码：

if ($db_found) {
    if(isset($_POST['submit'])) {
        //if username field is empty echo below statement
        if (empty ($clientid)){
            echo "you must enter your unique username <br />";
        }
    } else {   
        $query = "SELECT * FROM wp_locations WHERE client = '". mysqli_real_escape_string($clientid) ."'" ;
        $result = mysqli_query($query) or die("Unable to query");
        $option = "";
        while($row=mysql_fetch_array($result)) {
            $option .= "<option value='{$row['client']}'>{$row['client']}</option>";
        }
    }
    if ($result){
        print $option;
        echo "query successfull";
        header('location: http://www.google.com');
    } else {
        echo"query fail";
    }
//end of initial if $db_found
} else {
    print "Database NOT Found ";
}

现在您可以很容易地看到，您只在未提交表单时才形成查询。我很确定这不是你想要的。是吗？？？

您希望类似于：

if ($db_found) {
    if(isset($_POST['submit'])) {
        //if username field is empty echo below statement
        if (empty ($clientid)){
            echo "you must enter your unique username <br />";
        }
        $query = "SELECT * FROM wp_locations WHERE client = '". mysqli_real_escape_string($clientid) ."'" ;
        $result = mysqli_query($query) or die("Unable to query");
        $option = "";
        while($row=mysql_fetch_array($result)) {
            $option .= "<option value='{$row['client']}'>{$row['client']}</option>";
        }
        if ($result){
            print $option;
            echo "query successfull";
            header('location: http://www.google.com');
        } else {
            echo"query fail";
        }
    }
//end of initial if $db_found
} else {
    print "Database NOT Found ";
}

但是您仍然有使用 mysql_* 与 mysqli_* 混合使用的问题 扩展只使用 mysqli_* 然后您需要查看函数以使用正确的参数，例如 mysqi_query 现在采用最少两个参数。看看这些参考资料：

• http://us2.php.net/manual/en/mysqli-result.fetch-array.php
• http://us2.php.net/manual/en/mysqli.real-escape-string.php
• http://us2.php.net/manual/en/mysqli.query.php

解决方案： 下面应该是我尚未测试此代码的工作解决方案，但它应该是您正在寻找的。通常我不会到这种程度来做别人的工作，但今天早上我感到很慷慨。

<form name="enterclient" method="post">
<label for="clientid">Enter your client id</label><br />
<input name="clientid" id="clientid"><br /><br />
<input type="submit" value="Submit" name="submit" id="submit">
</form>

<?php

global $current_user;
get_currentuserinfo();
$host = 'myhost';
$username = 'myuser';
$pass = 'mypass';
$database = 'mydb';
//connect to MySQL database
$link = mysqli_connect($host,$username,$pass, $database);
//if not connected kill page and throw error
if (!$link) {
    die('Connect Error (' . mysqli_connect_errno() . ') '
            . mysqli_connect_error());
}
//check if form submitted and clientid is not empty
if(isset($_POST['clientid']) && !empty($_POST["clientid"]))){
    //escape clientid to use in query
    $clientid = mysqli_real_escape_string($link,$_POST['clientid']);
    //form query
    $query = "SELECT client FROM wp_locations WHERE client = '$clientid'";
    //run query on server and if not successful then kill page and throw error
    $result = mysqli_query($link, $query) or die(mysqli_error($link));
    //set variable to fill with database data and print
    $option = "";
    //check if any rows were returned from database
    if(mysqli_num_rows($result)>0){
        //for each row that was returned set $row equal to an array of values for that row
        while($row=mysqli_fetch_array($result)) {
            //set $option with values from the database as there is only possible one value use = instead of .=
            $option = "<option value='{$row['client']}'>{$row['client']}</option>";
        }
        //print the option
        print $option;
        //show that the query was successful
        print "query successful";
        //set redirect to happen in 5 seconds
        $redirect = "http://www.google.com";
        $wait = 5; // seconds to wait
        print "You will be redirected to $redirect in $wait seconds."
        print "<span style='display:none'><meta http-equiv='Refresh' content='$wait; URL=$redirect'></span>";
    } else {
        //show that the query was successful but that the client was not found
        print "query successful but client not found please try again";
    }
    //free the MySQL result set
    mysqli_free_result($result);
} else {
    //the form was either not submitted or submitted with an empty value.
    print "Please complete and submit the form above.";
}
//close the connection to the MySQL server
mysqli_close($link);

?>