將驗證添加到PDO

-1

得到了這種工作，我想如何，但我可以做些什麼更新，使其更好？將驗證添加到PDO

代碼：----------------------------------------

$odb = new PDO('mysql:host=localhost;dbname=db371885849', $user, $pass); 
    $odb->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 


     if(isset($_POST['firstname'])) { 
       $firstname = $_POST['firstname']; 
       $lastname = $_POST['lastname']; 
       $email = $_POST['email']; 

         $q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);"; 
         $query = $odb->prepare($q); 
         $results = $query->execute(array(
         ":firstname" => $firstname, 
         ":lastname" => $lastname, 
         ":email" => $email 
       )); 
       }

++++++++++++++++++++++++更新工作+++++++++++++++++++++ +++++

$odb = new PDO('mysql:host=localhost;dbname=db371885849', $user, $pass); 
    $odb->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

     if(isset($_POST['firstname'])) { 
       $firstname = $_POST['firstname']; 
       $lastname = $_POST['lastname']; 
       $email = $_POST['email']; 
if (!empty($firstname)) 
{ 

         $q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);"; 
         $query = $odb->prepare($q); 
         $results = $query->execute(array(
         ":firstname" => $firstname, 
         ":lastname" => $lastname, 
         ":email" => $email 
       )); 
       } else { 
      echo "not today"; 
     } 
       }

來源

2013-05-17 Switchfire

嘗試使用'empty（trim（$ _ POST ...' – hjpotter92

）爲什麼你認爲它與PDO有關？ –

http://stackoverflow.com/questions/5152223/divide-php-errors-and-application-錯誤 –

if(!empty($_POST['firstname']) && !empty($_POST['lastname']) && filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)) { 
      $firstname = $_POST['firstname']; 
      $lastname = $_POST['lastname']; 
      $email = $_POST['email']; 

        $q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);"; 
        $query = $odb->prepare($q); 
        $results = $query->execute(array(
        ":firstname" => $firstname, 
        ":lastname" => $lastname, 
        ":email" => $email 
      )); 
     }else echo 'make an error';

來源

2013-05-17 10:53:04 Sam

爲什麼-1？自己解釋 – Sam

我正要問我同樣的問題o_O +1。 – mingos

如果我沒有弄錯，在這個小片段中，'firstname'單詞出現了7次。你不覺得它有點太過分了嗎？ –

PDO用於與數據庫進行通信，而不是驗證值（除了引用安全插入）。你將不得不執行驗證你與PDO啓動您的SQL查詢之前：

<?php 
if ($_SERVER["REQUEST_METHOD"] == "POST") { 
    if (
     // your empty() checks 
    ) { 
     // your query 
    } 
}

來源

2013-05-17 10:52:45 mingos

好，所以這個代碼應該建立在查詢連接之前，設置了對變量的驗證？ – Switchfire

您可以更早地連接，連接不成問題。我想說的是，你應該手動驗證你的字段，一旦你確定他們全部驗證，你可以繼續啓動一個INSERT查詢。爲了使事情變得更容易，你也可以考慮使用一些PHP框架，或者至少它的驗證器組件。 Zend Framework有一套體面的，相當完整的驗證器，您可以單獨使用。 – mingos

看來你不需要任何驗證可言。所以，我怎麼會做的，基於從標籤維基代碼

<?php 
if ($_SERVER["REQUEST_METHOD"] == "POST") { 
    $allowed = array('firstname', 'lastname', 'email'); 
    $sql = "INSERT INTO jobform SET ".pdoSet($fields,$values); 
    $stm = $dbh->prepare($sql); 
    $stm->execute($values); 
    header("Location: ".$_SERVER['PHP_SELF']); 
    exit; 
}

但是，如果你想驗證用戶輸入，你會酬勞更復雜的代碼：

<? 
$allowed = array('firstname', 'lastname', 'email'); 
if ($_SERVER['REQUEST_METHOD']=='POST') { 

    $err = array(); 
    //performing all validations and raising corresponding errors 
    if (empty($_POST['firstname']) $err[] = "Firstname is required"; 
    if (empty($_POST['lastname']) $err[] = "Lastname is required"; 
    if (!filter_var($_POST['email'],FILTER_VALIDATE_EMAIL) { 
    $err[] = "Wrong email format"; 
    } 

    if (!$err) { 
    $sql = "INSERT INTO jobform SET ".pdoSet($fields,$values); 
    $stm = $dbh->prepare($sql); 
    $stm->execute($values); 
    header("Location: ".$_SERVER['PHP_SELF']); 
    exit; 
    } else { 
    // all field values should be escaped according to HTML standard 
    foreach ($_POST as $key => $val) { 
     $form[$key] = htmlspecialchars($val); 
    } 
} else { 
    foreach ($allowed as => $val) { 
     $form[$val] = ''; 
    } 
} 
include 'form.tpl.php';

來源

2013-05-17 11:12:42

感謝您的幫助，pdoSet對我來說是新的，Il看看我是否可以將其發展爲我的腳本，再次感謝。 – Switchfire

將驗證添加到PDO

回答

相關問題