使用PHP格式化文本

Question

有沒有一種方法可以格式化一個列表，以便我可以通過SQL插入它？

我目前的列表格式是test:test，我希望能夠格式化它，以便將其插入到我的數據庫中。

INSERT INTO `test` (`user`, `file`) VALUES 
('test', 'test'), 
('test2', 'test2'), 
('test@test3.com', 'test3'); 

這是可能的嗎？

<? 
if($_POST['oldlist']){ 

$sql = "SELECT * FROM test WHERE user='$_POST[oldlist]'"; 
$result = mysql_query($sql) or die(mysql_error()); 
if(mysql_num_rows($result) > 0) { echo "exists";} else { 

$sqlq = "INSERT INTO test (`user` ,`file`) 
VALUES ('$_POST[oldlist]');"; 
$add = mysql_query($sqlq) or die(mysql_error()); 
if($add){echo "done";}else {echo "failed";} 
}} 
?> 

這是什麼意思？我希望能夠發佈一個列表並將其插入到我的數據庫中，但它必須先格式化。

Answer 1

你的代碼中有一個令人討厭的SQL注入漏洞。確保你逃避你的價值！以下是我建議你逃避你的代碼，並將其插入到你的數據庫：

<?php 
// Use isset to determine whether there is a value present 
if(isset($_POST['oldlist'])){ 

    $oldlist = $_POST['oldlist']; 
    // Escape your data. Makes sure someone inject code that can jack your DB 
    $oldlist_esc = mysql_real_escape_string($oldlist); 

    $sql = "SELECT * FROM test WHERE user='$oldlist_esc'"; 
    $result = mysql_query($sql) or die(mysql_error()); 
    if(mysql_num_rows($result) > 0) 
     echo "exists"; 
    else { 
     // I'll assume your data is line-delimited 
     $oldlist = explode("\n", $oldlist); 
     $new_oldlist = $oldlist; 
     foreach($oldlist as $key=>$value) { 
      $new_oldlist[$key] = explode(" ", $value, 1); // I'll assume each line is space-delimited 

      // Escape the new data 
      foreach($new_oldlist[$key] as $new_key=>$new_value) 
       $new_oldlist[$kew_key] = mysql_real_escape_string($new_value); 
     } 
     $sqlq = "INSERT INTO test (`user` ,`file`) VALUES "; 

     // Build out the query 
     $c = 0; 
     foreach($new_oldlist as $value) { 
      if($c++ > 0) $sqlq .= ','; 
      $sqlq .= '("'; 
      $sqlq .= implode('","', $value); 
      $sqlq .= '")'; 
     } 

     $add = mysql_query($sqlq) or die(mysql_error()); 
     if($add) 
      echo "done"; 
     else 
      echo "failed"; 
    } 
} 

?> 

它的優良使用內部字符串變量（即：「asdfasdf MYVAR $ asdfasdf」），但要記住使用mysql_real_escape_string逃脫你的數據。這樣可以防止用戶注入數據，例如：

';DELETE FROM test WHERE true;-- 

這會有效擦除數據庫。希望這可以幫助！

Answer 2

如果你的$ _POST一個數組裏面一些配對值，試圖通過爆炸的每個數組的元素的「：」，用正確的語法加入他們的單個插入，再加入整個陣列的多重插入：

<? 
// Just added 'olduser' as it seemed to go with WHERE user=... , change to your needs 
if($_POST['olduser'] && $_POST['oldlist']){ 

$sql = "SELECT * FROM test WHERE user='$_POST[olduser]'"; 
$result = mysql_query($sql) or die(mysql_error()); 
if(mysql_num_rows($result) > 0) { echo "exists";} else { 

foreach ($_POST['oldlist'] as &$each) 
{ 
    $each = explode(":",$each); 
    $each = "('".join("','",$each)."')"; 
} 

$_POST['oldlist'] = join(",",$_POST['oldlist']); 

// no semi-colon at end 
$sqlq = "INSERT INTO test (`user` ,`file`) VALUES $_POST[oldlist]"; 
$add = mysql_query($sqlq) or die(mysql_error()); 
if($add){echo "done";}else {echo "failed";} 
}} 
?> 

無論如何，要小心你的陳述，我不會保留它，即使在本地使用時也不會消毒查詢。