2014-01-09 109 views
0

我需要一些幫助來理解mysql的插入和更新方法。我正在運行Mamp,我知道php和mysql正在工作。我的數據庫設置的方式是在信息表中有一個鍵。數據被加密到數據庫中,並在顯示到passbook.html時解密。目前數據可以更新,但如果更改了用戶名或密碼,則會將新條目放入數據庫中,而不是更新它。我該如何解決這個問題才能進行數據更新。如果更改了密碼或用戶名,則應該進行更新。如果網站被更改,它應該創建一個新條目並刪除舊條目。Mysql插入和更新

passbook.html

<!DOCTYPE html> 
<html> 
<head> 
    <title>Passbook</title> 
</head> 
<body > 

<header> 

<h1> My Passbook</h1></header> 
</header> 
<body>   
<?php 
    $count = 1; 
?> 

<style> 
#pass a{ 
visibility:hidden; 
} 
#pass:hover a{ 
visibility:visible; 
} 
td{ 
    text-align:center; 
} 
</style> 

    <script type="text/javascript"> 
function checkBox(checkbox){ 
if(checkbox.checked) 
    checkbox.value = 'Yes'; 
else 
    checkbox.value = 'No'; 
} 

function addRow(){ 
      var table = document.getElementById('table'); 
      var row = table.insertRow(-1); 


      var count = document.getElementById('table').rows.length - 1; 

      row.innerHTML="<td name='row' value='"+count+"'>"+count+"</td>" 
         + "<td><input name='" + count + "check' type='checkbox' value=''></input></td>" 
         + "<td><input name='" + count + "web' type='text'></input></td>" 
         + "<td><input name='" + count + "user' type='text'></input></td>" 
         + "<td><input name='" + count + "pass' type='text'></input></td>"; 


         document.getElementById('custom').value = count; 

      } 

</script> 

<form method="post" action="passbook.php"> 
<table id="table" border=5;> 
<th>Row #</th> 
<th>Selected</th> 
<th>Websites</th> 
<th>Usernames</th> 
<th>Passwords</th> 

<?php 
session_start(); 
$connection = mysql_connect('localhost', $_SESSION['username'], $_SESSION['password']) or die ("Could not connect"); 
$key = mysql_query('SELECT `key` FROM `'.$_SESSION['username'].'`.`info`'); 
$string = 'SELECT * FROM `'.$_SESSION['username'].'`.`passbook` WHERE 1'; 
$result = mysql_query($string); 
    while($row = mysql_fetch_assoc($result)) 
    { 
     $decUser = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($row['username']), MCRYPT_MODE_CBC, md5(md5($key))), "\0"); 
     $decPass = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($row['password']), MCRYPT_MODE_CBC, md5(md5($key))), "\0"); 
     if($row['selected'] == 1) 
      echo "<tr><td style='text-align:center;' value='".$count."'>".$count."</td> 
        <td><input type='checkbox' name='".$count."check' value='1' checked></td> 
        <td><input type='text' name='".$count."web' value='".$row['website']."'><br></td> 
        <td id='user'><a><input type='text' name='".$count."user' value='".$decUser."'></a></td> 
        <td id='pass'><a><input type='text' name='".$count."pass' value='".$decPass."'></a></td> 
        </tr>"; 
     else if($row['selected'] == 0) 
      echo "<tr><td style='text-align:center;' value='".$count."'>".$count."</td> 
        <td><input type='checkbox' name='".$count."check' value='0'></td> 
        <td><input type='text' name='".$count."web' value='".$row['website']."'><br></td> 
        <td id='user'><a><input type='text' name='".$count."user' value='".$decUser."'></a></td> 
        <td id='pass'><a><input type='text' name='".$count."pass' value='".$decPass."'></a></td> 
        </tr>"; 
    $count++; 
    } 
    ?> 
    </table> 


    <br/> 
<input type="button" value="Add row" id="AddRow" onclick="addRow()"></input> 
<input type="submit" value="Save Table"></input> 
</form> 
    <br/><br/> 
<label id="yes"></label> 

<script type="text/javascript"> 
function GotoPage() 
{ 
var loc = document.getElementById('scroller').value; 
if(loc!="0") 
window.location = loc; 
} 
</script> 


<select id="scroller" style="height:42px; width:145px;" onchange="GotoPage()" > 
<optgroup label="Home"> 
<option value="homepage.html">Home</option> 
</optgroup> 
<optgroup label="View Credentials" > 
<option value="passbook.html" selected>Passbook</option> 
</optgroup> 
<optgroup label="Other" > 
<option value="settings.html" >Settings</option> 
</optgroup> 
</select> 

</body></html> 

passbook.php

session_start(); 

$connection = mysql_connect('localhost', $_SESSION['username'], $_SESSION['password']) or die ("Could not connect"); 
$db = mysql_select_db($_SESSION['username'],$connection); 
    $num = 0; 

foreach ($_POST as $data => $value){ 
    $num = substr($data, 0 , 1); 
} 
    $string = "SELECT `key` FROM `info`"; 
    $key = mysql_query($string) or die("failureeee"); 

    for($i = 1; $i <= $num; $i++){ 
    $username = $_POST[$i.'user']; 
    $password = $_POST[$i.'pass']; 
    $encUser = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), substr($username,strlen($i)-1), MCRYPT_MODE_CBC, md5(md5($key)))); 
    $encPass = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), substr($password,strlen($i)-1), MCRYPT_MODE_CBC, md5(md5($key)))); 
    $website = $_POST[$i.'web']; 
    echo "Encrypt" . "<br>" . $_POST[$i.'check'] . " " . $website . " " . $encUser. " " . $encPass . "<br>"; 


    if(isset($_POST[$i.'check'])){ 
      $q = "SELECT * FROM `passbook` WHERE `website`='".$website."'"; 
      $select = mysql_query($q); 
      while($info = mysql_fetch_assoc($select)){ 
       if($info == $website){ 
        $query = "UPDATE `passbook` SET `selected` = '1',`username` = '".$encUser."',`password`='".$encPass."' WHERE `website`='".$website."'"; 
        $run = mysql_query($query); 
       } 
      } 
      if(!isset($query)){ 
       $query = "INSERT INTO `passbook` (`selected`,`website`,`username`,`password`) VALUES ('1','".$website."','".$encUser."','".$encPass."')"; 
       $run = mysql_query($query); 
       echo "<br>INSERT web=".$website."<br>"; 
      } 
    } 
    else{ 
     $q = "SELECT `website` FROM `".$_SESSION['username']."`.`passbook`"; 
      $select = mysql_query($q); 
      while($info = mysql_fetch_assoc($select)){ 
       if($info == $website){ 
        $q2 = "UPDATE `passbook` SET `selected` = '0',`username` = '".$encUser."',`password`='".$encPass."' WHERE `website`='".$website."'"; 
       } 

      } 
      if(!isset($q2)){ 
       $run = mysql_query($q2); 
      } 
      else{ 
      $q2 = "INSERT INTO `passbook` (`selected`,`website`,`username`,`password`) VALUES ('0','".$website."','".$encUser."','".$encPass."')"; 
      $run = mysql_query($q2); 
       } 
     } 
    } 

回答

0

你的PHP有重大失誤。

  • mysql_職能正在貶值
  • 您直接將用戶提交的數據到數據庫中,讓你容易受到SQL注入
  • 您的代碼是不符合邏輯

在下面的代碼你試圖比較一個數組 - $ info - 和一個字符串 - $網站。

while($info = mysql_fetch_assoc($select)){ 
    if($info == $website){ 
     $query = "UPDATE `passbook` SET `selected` = '1',`username` = '".$encUser."',`password`='".$encPass."' WHERE `website`='".$website."'"; 
     $run = mysql_query($query); 
    } 
} 

我想你的意思做的是:

while($info = mysql_fetch_assoc($select)){ 
    // $info is an array that holds the row's data. You access an individual "cell" by referencing the column name as the key 
    if($info['website'] == $website){ 
     $query = "UPDATE `passbook` SET `selected` = '1',`username` = '".$encUser."',`password`='".$encPass."' WHERE `website`='".$website."'"; 
     $run = mysql_query($query); 
    } 
} 

然後在此代碼檢查$ Q2被設置,如果不是,你......嘗試執行使用它進行查詢?沒有意義。

if(!isset($q2)){ 
    $run = mysql_query($q2); 
} 

這是意見比什麼都重要,但是......你的「加密」方案是毫無意義的。您將密鑰與加密數據一起存儲。如果有人訪問你的數據庫(如果你沒有修復SQL注入問題,他們會得到),他們將擁有解密數據所需的一切。

+0

謝謝。你會推薦什麼作爲加密方案? – CrazyJohnny