3
試圖在我的網站上創建評論應用程序。 儘管「發佈」到AJAX javaScript文件，但數據未正確插入。 這裏是主頁：http://micromedia.vaniercollege.qc.ca/home/nortonb/php/mySQL php AJAX數據沒有從AJAX js文件插入
作品：[email protected]傳：
可以使用已註冊的用戶插入註釋SN （注：警報是從JS/ajax.js）
- 包括主頁上的DB/comments.php文件顯示評論
- 包括對JS/ajax.js文件上提交
傳遞信息通過以comment_ins.php jax.js文件
<input name="submit" type="button" class="indent" value="add your comment" onclick="loadXMLDoc('db/comments_ins.php')">
不起作用：
如果用戶的電子郵件並沒有在數據庫，comment_ins.php顯示與firstName和lastName投入另一種形式存在。
它使用相同的ajax.js文件，但現在db/comments_add_user.php插入新用戶，然後將其註釋插入到相關表中。
（注：該參數被傳遞到ajax.js文件，但該信息未在數據庫提交）
我曾嘗試： 難的編碼DB/comments_add_user.php工程數據
-passing從常規形式的信息，但仍然使用JS/ajax.js工作提前
http://micromedia.vaniercollege.qc.ca/home/nortonb/php/c_test.htm
感謝。 布魯斯
這裏是我的index.php文件的膽量：
<h4>Comments</h4>
<article id="comms">
<form name="intro" action="" method="post">
<fieldset>
<legend>Add your comment</legend>
<label for="comment">
Comments:<br /><textarea name="comment" id="comment" cols="30" rows="5" class="indent"></textarea><br />
</label>
<label for="email">
Email:<br /><input name="email" id="email" type="text" size="32" class="indent"/>
<span id="emailMessage"></span>
</label><br />
<label for="password">
Password:<br /><input name="password" id="password" type="password" size="32" class="indent"/>
<span id="passwordMessage"></span>
</label><br />
<input name="submit" type="button" class="indent" value="add your comment" onclick="loadXMLDoc('db/comments_ins.php')">
</fieldset>
</form>
<?php include("db/comments.php"); ?>
</article>
這裏是JS/ajax.js文件：
// JavaScript Document
function loadXMLDoc(xmlDoc){
var xmlhttp;
if (window.XMLHttpRequest){// code for IE7+, Firefox, Chrome, Opera, Safari
xmlhttp=new XMLHttpRequest();
}else{// code for IE6, IE5
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
xmlhttp.onreadystatechange=function(){
if (xmlhttp.readyState==4 && xmlhttp.status==200){
document.getElementById("comms").innerHTML=xmlhttp.responseText;
}
}
var commentValue=encodeURIComponent(document.getElementById("comment").value);
var emailValue=encodeURIComponent(document.getElementById("email").value);
var passwordValue=encodeURIComponent(document.getElementById("password").value);
var parameters="comment="+commentValue+"&email="+emailValue+"&password="+passwordValue;
//if a new user then add these things
if(document.getElementById("firstName")){
var firstNameValue=encodeURIComponent(document.getElementById("firstName").value);
var lastNameValue=encodeURIComponent(document.getElementById("lastName").value);
//parameters are formatted in name=value pairs
var parameters="firstName="+firstNameValue+"&lastName="+lastNameValue+"&comment="+commentValue+"&email="+emailValue+"&password="+passwordValue;
}
alert(xmlDoc + " parameters: "+parameters);
xmlhttp.open("POST", xmlDoc, true);//true = asynchronous
xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xmlhttp.send(parameters);
}
這裏是DB/comments_ins.php （這看起來工作正常）
<?php
//comments_ins.php adds new comments to the database
//if the user has already registered, the comment is displayed
//else a form is displayed for new users keeping the comment and email from the original comment form
//to do list:
// ??? should I combine this into comments.php?
// ??? should I separate the forms into a separate .php file with a conditional for new users?
//fix scrolling issue?
//jQuery? AJAX?
include 'includes/mysqli_connect.php';
//get the posted info
echo("comments_ins.php<br />");
if(isset($_POST["comment"])){
$password = trim($_POST["password"]);
$hashedPassword = hash(sha256,$password);
$email = trim($_POST["email"]);
$comment = trim($_POST["comment"]);
//see if user exists
$query = "select * from users where email = '$email' and password = '$hashedPassword' limit 1";//adding limit 1 speeds up the query on big tables
$result = mysqli_query($link, $query);
//get response from database
if($result = mysqli_query($link, $query)){
$numrows = $result->num_rows;
//echo ('found '.$numrows.' user: <br>'. $firstName.'<br>');
while ($row = $result->fetch_object()) {
$userArray[] = array('userID'=>$row->userID,
'firstName'=>$row->firstName,
'lastName'=>$row->lastName,
'email'=>$row->email
);//line breaks for readability
}
$verifiedUserID = $userArray[0]['userID'];//get userID for insert below
//echo("\$verifiedUserID: ".$verifiedUserID);
}else{
// This means the query failed
echo("errr...");
echo $mysqli->error;
}
//if the user already exists...
if($numrows > 0){//should add something if numrows > 1 i.e. for duplicate users!!
//echo("user is registered <br />");
$commentQuery="INSERT INTO comments (comment, userID) VALUES ('$comment', '$verifiedUserID')";
$commentResult = mysqli_query($link, $commentQuery);
//get response from database
$commentNum = mysqli_affected_rows($link);
echo(mysqli_error());
//echo ('<br />inserted '.$commentNum.' record: <br />'. $comment.'<br />');
include("comments.php");
}else{//if the user does not exist
echo("Please register to display your comment: <br />");
?>
<form name="intro" action="" method="post">
<fieldset>
<legend>Register to share your comment:</legend>
<label for="firstName">
First Name: <br />
<input name="firstName" id="firstName" type="text" class="indent" size="32" />
<span id="firstMessage"></span>
</label>
<br />
<label for="lastName">
Last Name:<br />
<input name="lastName" id="lastName" type="text" class="indent" size="32" />
<span id="lastMessage"></span>
</label>
<br />
<label for="email">
Email:<br />
<input name="email" id="email" type="text" size="32" class="indent" value="<?php echo($email); ?>"/>
<span id="emailMessage"></span>
</label>
<br />
</label>
<label for="password">
Password:<br />
<input name="password" id="password" type="password" size="32" class="indent"/>
<span id="passwordMessage"></span>
</label>
<br />
<label for="comment">
Edit your comment?<br />
<textarea name="comment" id="comment" cols="30" rows="5" class="indent"><?php echo($comment); ?></textarea>
</label> <br />
<input name="submit" type="submit" class="indent" value="join us" onclick="loadXMLDoc('db/comments_add_user.php')"/>
<p class="note">(Of course we will keep your stuff private!!)</p>
</fieldset>
</form>
<?php
}//end else($numrows <=0)
//close connection
mysql_close($link);
}
?>
而這裏是comments_add_user.php文件（CAL時不起作用從JS/ajax.js文件導致但從
<?php
include 'includes/mysqli_connect.php';
//get the posted info
echo("hi mom");
$firstName = $_POST["firstName"];//"Two";//
$lastName = $_POST["lastName"];//"Two";//
$password = $_POST["password"];//"Two";//
$hashedPassword = hash(sha256,$password);
$email = $_POST["email"];//"Two";//
$comment = $_POST["comment"];//"Two";//
echo($firstName." from comments_add_user.php<br>");
//since email does not exist,
$query="INSERT INTO users (firstName, lastName, password, email) VALUES ('$firstName', '$lastName', '$hashedPassword', '$email')";
$result=mysqli_query($link, $query);
//get response from database
$num= mysqli_affected_rows($link);
echo(mysqli_error());
echo ('inserted '.$num.' record: <br>'. $firstName.'<br>');
//** add error checking ?!?
//get the userID for the new user
$userQuery = "select userID from users where email = '$email' limit 1";//adding limit 1 speeds up the query on big tables
$userResult = mysqli_query($link, $userQuery);
//get response from database
if($userResult = mysqli_query($link, $userQuery)){
$numrows = $userResult->num_rows;
echo ('found '.$numrows.' user: <br>'. $firstName.'<br>');
while ($row = $userResult->fetch_object()) {
$userArray[] = array('userID'=>$row->userID);//line breaks for readability
}
$newUserID = $userArray[0]['userID'];//get userID for insert below
//echo("\$verifiedUserID: ".$verifiedUserID);
}else{
// This means the query failed
echo("errr...");
echo $mysqli->error;
}
//now insert the comment
$commentQuery="INSERT INTO comments (comment, userID) VALUES ('$comment', '$newUserID')";
$commentResult=mysqli_query($link, $commentQuery);
//get response from database
$commentNum= mysqli_affected_rows($link);
echo(mysqli_error());
echo ('inserted '.$commentNum.' record: <br>'. $comment.'<br>');
echo('<br><a href="comments_display.php">display all comments</a><br />');
//close connection
mysql_close($link);
?>
你有好的SQL注入漏洞......如果有人開着一輛卡車通過它們進入你的服務器，那該多糟糕。 –
感謝Mark B.我知道我應該在發佈之前插入它們。 –
沒有更多的卡車。增加了一些削減和剝離。計劃添加準備好的語句，一旦我得到這個工作。再次感謝Mark B. –