通過PHP連接mySQL db

Question

讓我開始說我對此非常陌生。我正在嘗試開發一款沒有真實體驗的移動應用和網站。有可能是我錯過了或我做錯了，但我似乎無法指出問題在哪裏。在創建我自己的之前，我遵循了一個視頻指南（演示文件下載到我的電腦），但似乎無法連接到我的數據庫。我也複製了這些演示文件，並將它們放入我的代碼中，但它仍然讓我陷入了一個部分。我正在使用程序MAMP進行連接，並使用Brackets作爲代碼。下面是我的會議文件：

數據庫連接 -

<?php 

$dbServername = "localhost"; 
$dbUsername = "root"; 
$dbPassword = "root"; 
$dbName = "Login System"; 

$con = mysqli_connect($dbServername, $dbUsername, $dbPassword, $dbName); 

我的註冊文件 -

<?php 

if (isset($_POST['submit'])) { 

    include_once 'dbh.inc.php'; 

    $first = mysqli_real_escape_string($conn, $_POST['first']); 
    $last = mysqli_real_escape_string($conn, $_POST['last']); 
    $email = mysqli_real_escape_string($conn, $_POST['email']); 
    $uid = mysqli_real_escape_string($conn, $_POST['uid']); 
    $pwd = mysqli_real_escape_string($conn, $_POST['pwd']); 

    //Error handlers 
    //Check for empty fields 
    if (empty($first) || empty($last) || empty($email) || empty($uid) || empty($pwd)) { 
     echo <h2>Please fill in all fields; 
     exit(); 
    } else { 
     //Check if input characters are valid 
     if (!preg_match("/^[a-zA-Z]*$/", $first) || !preg_match("/^[a-zA-Z]*$/", $last)) { 
      header("Location: ../signup.php?signup=invalid"); 
      exit(); 
     } else { 
      //Check if email is valid 
      if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { 
       header("Location: ../signup.php?signup=email"); 
       exit(); 
      } else { 
       $sql = "SELECT * FROM users WHERE user_uid='$uid'"; 
       $result = mysqli_query($conn, $sql); 
       $resultCheck = mysqli_num_rows($result); 

       if ($resultCheck > 0) { 
        header("Location: ../signup.php?signup=usertaken"); 
        exit(); 
       } else { 
        //Hashing the password 
        $hashedPwd = password_hash($pwd, PASSWORD_DEFAULT); 
        //Insert the user into the database 
        $sql = "INSERT INTO users (first, last, email, uid, pwd) VALUES ('$first', '$last', '$email', '$uid', '$hashedPwd');"; 
        mysqli_query($conn, $sql); 
        header("Location: ../signup.php?signup=success"); 
        exit(); 
       } 
      } 
     } 
    } 

} else { 
    header("Location: ../signup.php"); 
    exit(); 
} 

?> 

我的登錄表

<?php 
    include_once 'header.php'; 
?> 

    <section class="main-container"> 
     <div class="main-wrapper"> 
      <h2>Signup</h2> 
      <form class="signup-form" action="includes/signup.inc.php" method="POST"> 
       <input type="text" name="first" placeholder="Firstname"> 
       <input type="text" name="last" placeholder="Lastname"> 
       <input type="text" name="email" placeholder="E-mail"> 
       <input type="text" name="uid" placeholder="Username"> 
       <input type="password" name="pwd" placeholder="Password"> 
       <Button type="submit" name="submit">Sign up</Button> 
      </form> 

     </div> 
    </section> 

<?php 
    include_once 'footer.php'; 
?> 

我已將「root」密碼重置爲「root」，並確保可以使用該密碼登錄。如果任何字段爲空，則檢查錯誤列表的文檔返回到URL中帶有「= empty」字樣的前一頁。無論我在我的字段中輸入什麼信息，它都不會將信息推送到數據庫中，或者我錯誤地映射了我的字段，因此其中一個數據庫字段爲空。

任何幫助將不勝感激。正如我在本文開頭所說的那樣，我對此非常陌生。你可能會看到一些令人難以置信的明顯而有些愚蠢的東西......你被警告過！我正在創建一個允許用戶登錄的移動應用程序和網站。登錄嘗試將引用我的本地主機數據庫，以確認用戶不存在或用戶未使用。

謝謝！

Answer 1

檢查連接處理，你可以連接嘗試後補充一點：

$conn = mysqli_connect(...); 

if (!$conn) { 
    die('Did not connect: ' . mysqli_connect_error()); 
} 

要查詢後檢查處理，就可以查詢嘗試後補充一點：

$result = mysqli_query($conn, $sql); 

if (false === $result) { 
    die('Query error: ' . mysqli_error($conn)); 
} 

Answer 2

立即使用php -l，我在includes/signup.inc.php文件中的代碼中發現了一些錯誤。

行echo <h2>Please fill in all fields;沒有被引用，當我嘗試加載頁面時會導致錯誤500。要解決此問題，我添加了單引號echo '<h2>Please fill in all fields</h2>';並添加了</h2>以關閉HTML標記。

修復之後，頁面將返回Please fill in all fields即使我填寫了註冊表單中的所有字段。要解決此問題，我將mysqli_real_escape_string($conn, $_POST['POST_DATA']);更改爲strip_tags(trim($_POST['POST_DATA']));。

電子郵件線是一個有點不同，mysqli_real_escape_string($conn, $_POST['email']);改爲filter_var(trim($_POST['email'], FILTER_SANITIZE_EMAIL));

我也改變了$hashedPwd = password_hash($pwd, PASSWORD_DEFAULT);（PHP文件：http://php.net/manual/en/function.password-hash.php）行補充鹽分。什麼是鹽？

In cryptography, a salt is random data that is used as an additional input to a one-way function that "hashes" a password or passphrase. Salts are closely related to the concept of nonce. The primary function of salts is to defend against dictionary attacks or against its hashed equivalent, a pre-computed rainbow table attack.

來源：en.wikipedia.org/wiki/Salt_(cryptography）
在這篇文章中stackexchange也看一看/安全一些更多的信息鏈接：https://security.stackexchange.com/a/51983

---

新includes/signup.inc.php文件

<?php 
if (isset($_POST['submit'])) { 
    include_once 'dbh.inc.php'; 
    $first = strip_tags(trim($_POST['first'])); 
    $last = strip_tags(trim($_POST['last'])); 
    $email = filter_var(trim($_POST['email'], FILTER_SANITIZE_EMAIL)); 
    $uid = strip_tags(trim($_POST['uid'])); 
    $pwd = strip_tags(trim($_POST['pwd'])); 
    //Error handlers 
    //Check for empty fields 
    if (empty($first) || empty($last) || empty($email) || empty($uid) || empty($pwd)) { 
    echo '<h2>Please fill in all fields</h2>'; // was echo <h2>Please fill in all fields; which would cause an error 500 
    exit(); 
    } 
    else { 
    //Check if input characters are valid 
    if (!preg_match("/^[a-zA-Z]*$/", $first) || !preg_match("/^[a-zA-Z]*$/", $last)) { 
     header("Location: ../signup.php?signup=invalid"); 
     exit(); 
    } 
    else { 
     //Check if email is valid 
     if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { 
     header("Location: ../signup.php?signup=email"); 
     exit(); 
     } 
     else { 
     $sql = "SELECT * FROM users WHERE user_uid='$uid'"; 
     $result = mysqli_query($conn, $sql); 
     $resultCheck = mysqli_num_rows($result); 
     if ($resultCheck > 0) { 
      header("Location: ../signup.php?signup=usertaken"); 
      exit(); 
     } 
     else { 
      //Hashing the password 
      $options = [ 
      'cost' => 12, 
      ]; 
      $hashedPwd = password_hash($password, PASSWORD_BCRYPT, $options); // Adding salt to hashed password 
      //Insert the user into the database 
      $sql = " 
        INSERT INTO users (first, last, email, uid, pwd) 
        VALUES ('" . $first . "', 
        '" . $last . "', 
        '" . $email . "', 
        '" . $uid . "', 
        '" . $hashedPwd . "');"; 
      mysqli_query($conn, $sql); 
      header("Location: ../signup.php?signup=success"); 
      exit(); 
     } 
     } 
    } 
    } 
} 
else { 
    header("Location: ../signup.php"); 
    exit(); 
} 
?> 

此外，它會是一個好主意，學習如何使用的mysqli的OOP風格進行更復雜的數據庫操作上的mysqli
PHP文件：php.net/manual/en/mysqli.query .PHP
這也將是很好的添加一列作爲一個序列號，以允許使用此MySQL查詢的用戶值的後期編輯：至少有一個問題

ALTER TABLE `users` ADD `serial` INT PRIMARY KEY AUTO_INCREMENT;