我想顯示一個甜蜜的警報,如果SQL是真實的,但它不工作。 這是後端部分。
<?php
include "../../../config/config.php";
if (isset($_POST['submit-slider']))
{
$title = $_POST['title-slider'];
$description = $_POST['description-slider'];
$street = $_POST['street-slider'];
$phone = $_POST['phone-slider'];
$trip = $_POST['trip-slider'];
$web = $_POST['web-slider'];
$email = $_POST['email-slider'];
$target_dir = "../../../img/homepage/screen_4/";
$target_file2 = "" . basename($_FILES["img-slider"]["name"]);
$target_file = $target_dir . basename($_FILES["img-slider"]["name"]);
$uploadOk = 1;
$imageFileType = pathinfo($target_file, PATHINFO_EXTENSION);
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
// header("Location: /dashboard/views/slider/add_slider.php");
// if everything is ok, try to upload file
} else {
if (move_uploaded_file($_FILES["img-slider"]["tmp_name"], $target_file)) {
//echo "The file ". basename($_FILES["img"]["name"]). " has been uploaded.";
} else {
echo "Sorry, there was an error uploading your file.";
}
$query = "INSERT INTO images(title,
description,
street_1,
phone,
url,
trip_link,
img,
email
)
VALUES ('" . $title . "', '"
. $description . "', '"
. $street . "', '"
. $phone . "', '"
. $web . "', '"
. $trip . "', '"
. $target_file2 . "', '"
. $email . "')";
$result = mysqli_query($con, $query);
if ($result) {
$_SESSION['succes_slider'] = 1;
header("Location: /dashboard/views/slider/add_slider.php");
} else {
// $_SESSION['succes_slider'] = 0;
header("Location: /dashboard/views/slider/add_slider.php");
}
}
}
?>
這裏是我想要顯示甜蜜警報的頁面。
<?php
session_start();
if (!isset($_SESSION['name'])) {
header("Location: /dashboard/login.php");
}
//include "../config/config.php";
include "../../components/header.php";
include "../../components/menu.php";
if (isset($_SESSION['succes_slider']) == 1) {
echo" <script>
$(document).ready(function() {
swal('Succes','','succes');
});
</script>";
}
?>
</aside>
<!-- Content Wrapper. Contains page content -->
<div class="content-wrapper">
<!-- Content Header (Page header) -->
<section class="content-header">
<h1>
Hello
<small>HI</small>
</h1>
</section>
<!-- Main content -->
<section class="content">
我不知道爲什麼不工作,我知道..my代碼是MySQL的注入容易,但我不會在這個現在的工作。
甜警報正在我的登錄頁面上,如果能幫助別人知道爲什麼不工作的其他頁面上..
這裏是登錄的後端
if (isset($_POST['login'])) {
$email = mysqli_real_escape_string($con, $_POST['email']);
$password = mysqli_real_escape_string($con, $_POST['password']);
$sql = "SELECT * FROM users WHERE email='" . $email . "' AND password='" . md5($password) . "'";
$result = mysqli_query($con, $sql);
$row_count = mysqli_num_rows($result);
if ($row_count != 0) {
$row = mysqli_fetch_assoc($result);
$_SESSION['email'] = $email;
$_SESSION['name'] = $row['name'];
header("Location: /dashboard/index.php");
} else {
$_SESSION['error'] = 1;
header("Location: /dashboard/login.php");
}
}
的登錄的前端與其他頁面相同,區別在於會話的名稱。
你必須包括'在session_start() '在你使用'$ _SESSION'變量的所有文件中。 另外,您可能希望使用預處理語句或mysqli_real_escape_string來逃避輸入,以防止SQL注入。 – Bobby
**警告**:使用'mysqli'時,您應該使用[參數化查詢](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php)和['bind_param']( http://php.net/manual/en/mysqli-stmt.bind-param.php)將用戶數據添加到您的查詢中。 **不要**使用字符串插值或連接來完成此操作,因爲您創建了嚴重的[SQL注入漏洞](http://bobby-tables.com/)。 **絕不**將'$ _POST'或'$ _GET'數據直接放入查詢中,如果有人試圖利用您的錯誤,這會非常有害。 – tadman