從Web表單插入PDO

Question

我嘗試使用PHP和MySQL進行PDO插入的方式有什麼問題？

MySQL數據庫使用與（$ _POST）變量相同的名稱。

<?php 
if (!empty($_POST)) { 

//Declare Database Variables Here 

$dblist = ($_POST); 
$keys = array_keys($data); 

$dbcols = join(', ', array_values($keys)); 
$data = join(', ',array_values($dblist)); 

$dbtype = "mysql"; 
$dbhost = '127.0.0.1'; 
$dbname = 'bpstalent'; 
$dbuser = 'root'; 
$psword = 'root'; 
$portno = 3306; 

// if table_name is submitted, display dynamic table with another form request for table name 

$pdo = new PDO('mysql:host=' . $dbhost . ';port=' . $portno . 'dbname=' . $dbname . ';' . $dbuser . ';' . $psword . ';'); 

    echo "form submitted"; 

$sql = "INSERT INTO 'applicants'($dbcols) VALUES ($data)"; 

$stmt = $pdo->prepare($sql); 

$stmt->execute(); 

} 

else { 

?> 

HTML這裏

<? 
    ;} 
?> 

Answer 1

另外的形式，我覺得你是一個容易的目標SQL注入。我會改變

$sql = "INSERT INTO 'applicants'($dbcols) VALUES ($data)"; 

和替換的$值的列的硬編碼列表dbcols（它們可能來自一個數組爲好，只是沒有一個用戶發送）

對於$的數據我會取代與params什麼是由bindValue（）處理。您可以通過用「，：」替換「，」來將名稱轉換爲段落持有者。如果附和你最終的查詢會是這個樣子：

$sql = "INSERT INTO applicants (col1, col2, col3) VALUES (:col1, :col2, :col3)"; 

PHP中的文檔這個例子中，這將是值得你的時間，以確保這種形式：

http://www.php.net/manual/en/pdostatement.bindvalue.php

下面是一個經過改進的樣本你的腳本，未經測試，但應該給你如何使事情更安全的想法：

<?php 
if ($_POST) { 

    //HARDCODE COLUMNS, DO NOT RELY ON USER INPUT, BAD THINGS WILL HAPPEN IF YOU DO 
    $keys = array("col1", "col2", "col3"); 

    $dbcols = '`'.join('`, `', $keys).'`'; 
    $placeholders = ':'.join(', :', $keys); 

    //RUN THROUGH POST DATA LOOKING FOR YOUR KEYS, ONLY PASS TO DATABASE DATA YOU ARE EXPECTING TO SEE 
    $data = array(); 
    foreach ($keys as $k) 
    { 
     $data[$k] = $_POST[$k]; 
    } 

    //CONSIDER REPLACING THIS WITH require_once() FILE 
    $dbtype = "mysql"; 
    $dbhost = '127.0.0.1'; 
    $dbname = 'bpstalent'; 
    $dbuser = 'root'; 
    $psword = 'root'; 
    $portno = 3306; 

    $pdo = new PDO("$dbtype:host=$dbhost;port=$portno;dbname=$dbname", $dbuser, $psword); 
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

    $sql = "INSERT INTO applicants ($dbcols) VALUES ($placeholders)"; 
    $stmt = $pdo->prepare($sql); 
    $stmt->execute($data); 
}