PHP的XML請求MySQL

Question

其實我正在使用XML的Flash網頁。我想用XML創建一個單獨的頁面，它使用PHP將數據插入到MySQL數據庫中，但是我被卡住了......並且我的XML-PHP知識不足以完成此任務。

這是XML文件：

<?xml version="1.0" encoding="utf-8"?> 
<data> 
<title>Sing up</title> 
<request field1="user" field2="email" field3="password" field4="other">reg.php</request> 
<description><![CDATA[Please sing up!]]></description> 
</data> 

的REG PHP文件：

 <?php 

     function Reg() 
     { 
      if (isset($_POST['reg'])==true) { 
        require_once('db_conf.php'); 
       $user = $_POST['username']; 
       $pass = sha1(strtoupper($user.':'.$_POST['password'])); 
       $email = $_POST['email']; 

       $con = mysql_connect($dbhost, $dbuser, $dbpassword); 

       if (!$con) 
       { 
        die('Could not connect!'); 
       } else { 
        mysql_select_db("$logondb", $con); 

        $sql="INSERT INTO accounts (username, sha_pass_hash, email) VALUES ('$user','$pass','$email')"; 

        if (!mysql_query($sql,$con)) 
        { 
         die('Error creating account.'); 
        } 

        echo $succesmsg; 

        mysql_close($con); 

       } 


      } else { 
?> 

和PHP的conf數據庫：

<?php 
$dbhost = 'localhost'; 

$dbuser = 'user'; 

$dbpassword = 'password'; 

// Accounts Database 
$logondb = 'accounts'; 

$errormsg="Error creating account.."; 

$succesmsg="Account created!"; 
?> 

Answer 1

我想使用PDO，而不是建議 - 這是一個更一般的方法。然後，你應該使用數據綁定，以減少對SQL注入漏洞...

這應該帶你一步：

<?php 

     function Reg() 
     { 
      if (isset($_POST['reg'])==true) { 
       require_once('./db_conf.php'); 
       $user = $_POST['username']; 
       $pass = sha1(strtoupper($user.':'.$_POST['password'])); 
       $email = $_POST['email']; 

       $dsn = "mysql:host=$dbhost;dbname=$logondb"; 
       $pdo = new PDO($dsn,$dbuser,$dbpassword); 

       if (!$pdo) 
       { 
        die('Could not connect!'); 
       } else { 
        $sql = "INSERT INTO accounts (username, sha_pass_hash,email) VALUES (:user,:pass,:email)"; 
        $stmt = $pdo->prepare($sql); 
        $res = $stmt->execute(array("user"=>$user , "pass"=>$pass , "email" => $email)); 
        if (!$res) { 
         echo "Error :((<pre>"; 
         var_dump($stmt->errorInfo()); 
         echo "</pre>"; 
        } else 
        { 
         echo $succesmsg; 
        } 


       } 
      } else { 
       echo "reg was not set - terminating...!"; 
      } 

     } 

     Reg(); // execute it! 

?>