【发布时间】:2015-01-15 03:45:01
【问题描述】:
我一直在尝试使用教程来创建留言簿,但实际传输到我的留言簿的唯一数据是日期和时间。
我有一个数据库设置为:
Id|姓名|电子邮件|评论|日期时间
我有 3 页:
addguestbook.php
<?php
$host="localhost"; // Host name
$username="foo"; // Mysql username
$password="bar"; // Mysql password
$db_name="foo"; // Database name
$tbl_name="guestbook"; // Table name
// Connect to server and select database.
mysql_connect("$host", "$username", "$password")or die("cannot connect server ");
mysql_select_db("$db_name")or die("cannot select DB");
$datetime=date("y-m-d h:i:s"); //date time
$sql="INSERT INTO guestbook(Name, Email, Comment, Datetime)VALUES('$name', '$email', '$comment', '$datetime')";
$result=mysql_query($sql);
//check if query successful
if($result){
echo "Successful";
echo "<BR>";
// link to view guestbook page
echo "<a href='viewguestbook.php'>View guestbook</a>";
}
else {
echo "ERROR";
}
mysql_close();
?>
guestbook.php
<table width="400" border="0" align="center" cellpadding="3" cellspacing="0">
<tr>
<td><strong>Test Sign Guestbook </strong></td>
</tr>
</table>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form id="form1" name="form1" method="post" action="addguestbook.php">
<td>
<table width="400" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td width="117">Name</td>
<td width="14">:</td>
<td width="357"><input name='name' type="text" id="name" size="40" /></td>
</tr>
<tr>
<td>Email</td>
<td>:</td>
<td><input name='email' type="text" id="email" size="40" /></td>
</tr>
<tr>
<td valign="top">Comment</td>
<td valign="top">:</td>
<td><textarea name='comment' cols="40" rows="3" id="comment"></textarea></td>
</tr>
<tr>
<td> </td>
<td> </td>
<td><input type="submit" name="Submit" value="Submit" /> <input type="reset" name="Submit2" value="Reset" /></td>
</tr>
</table>
</td>
</form>
</tr>
</table>
<table width="400" border="0" align="center" cellpadding="3" cellspacing="0">
<tr>
<td><strong><a href="viewguestbook.php">View Guestbook</a> </strong></td>
</tr>
</table>
&viewguestbook.php
<table width="400" border="0" align="center" cellpadding="3" cellspacing="0">
<tr>
<td><strong>View Guestbook | <a href="guestbook.php">Sign Guestbook</a> </strong></td>
</tr>
</table>
<br>
<?php
$host="localhost"; // Host name
$username="foo"; // Mysql username
$password="bar"; // Mysql password
$db_name="foo"; // Database name
$tbl_name="guestbook"; // Table name
// Connect to server and select database.
mysql_connect("$host", "$username", "$password")or die("cannot connect server ");
mysql_select_db("$db_name")or die("cannot select DB");
$sql="SELECT * FROM $tbl_name";
$result=mysql_query($sql);
while($rows=mysql_fetch_array($result)){
?>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="400" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td>ID</td>
<td>:</td>
<td><? echo $rows['id']; ?></td>
</tr>
<tr>
<td width="117">Name</td>
<td width="14">:</td>
<td width="357"><? echo $rows['Name']; ?></td>
</tr>
<tr>
<td>Email</td>
<td>:</td>
<td><? echo $rows['Email']; ?></td>
</tr>
<tr>
<td valign="top">Comment</td>
<td valign="top">:</td>
<td><? echo $rows['Comment']; ?></td>
</tr>
<tr>
<td valign="top">Date/Time </td>
<td valign="top">:</td>
<td><? echo $rows['Datetime']; ?></td>
</tr>
</table></td>
</tr>
</table>
<?php
}
mysql_close(); //close database
?>
viewguestbook.php 工作正常,只是除了日期之外没有数据实际上进入我的数据库..
【问题讨论】:
-
您从未设置过
$name等,这意味着您可能假设register_globals已打开。可怕的假设。 register_globals 是一个非常愚蠢的想法,不应该超越鸡尾酒餐巾纸的阶段,并且理所当然地被 PHP 淘汰了。它目前在被点燃之前被切成非常非常小的碎片。 -
这也意味着你很容易受到sql injection attacks
-
你的
<form>从哪里开始?