PHP註冊問題

Question

我想知道在這段代碼中是否有錯誤/漏洞利用，也有人可以幫助我，因爲我註冊了它，但它並沒有將數據插入到數據庫中。如果有任何錯誤，請您糾正。我想要它，所以如果用戶名存在，將它們重定向到錯誤？= 1，以此類推，密碼不匹配。任何幫助表示讚賞。

Register.php

<form action="register_acc.php" method="post"> 
          <input type="text" name="username" class="input" value="" autocomplete="off" placeholder="Username" maxlength="25" /><br /> 
           <br /> 
          <input type="password" name="password" class="input" value="" autocomplete="off" placeholder="Password" maxlength="20" /><br /> 
           <br /> 
          <input type="password" name="password2" class="input" value="" autocomplete="off" placeholder="Password again" maxlength="20" /><br /> 
           <br /> 
          <input type="text" name="email" class="input" value="" autocomplete="off" placeholder="Email" maxlength="255" /><br /> 
           <br /> 
           <input type="submit" name="submit "class="submit" value="Sign up"> 
         </form> 

register_acc.php

<?php 
    error_reporting(1); 
    include 'site/inc/config.php'; 

     if (isset($_POST['submit'])) { 
session_start(); 

$username = $_POST['username']; 
$password = md5($_POST['password']); 
$pass_conf = md5($_POST['password2']); 
$email = $_POST['email']; 
$ip = $_SERVER['REMOTE_ADDR']; 
$date= date("d-m-Y"); 


$q = "SELECT * FROM `users` WHERE username = '$username'"; 
$r = mysql_query($q); 

if (empty($username)) { 
    header("Location: register.php?error=1"); 
     exit; 
} 

if ($password != $pass_conf) { 
    header("Location: /site/register.php?error=2"); 
     exit; 
} 

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { 
    header("Location: /site/register.php?error=3"); 
     exit; 
} 

if (mysql_num_rows($r) == 0) { 
    // Continue w/ registration, username is available! 
    $query = "INSERT INTO `users` (id, username, password, email, ip, rank, reg_date) 
    VALUES (0, '$username', '$password', '$email', '$ip', 1, '$date'())"; 
    $run = mysql_query($query); 
    header("Location: /site/register.php?succsess=1"); 

} 
      } 
     else { 
    header("Location: register.php?error=4"); 
      } 
     ?> 

Answer 1

你不串聯的$ username變量到查詢。 試試這個：

"SELECT * FROM `users` WHERE username = '".$username."'" 

而且您的INSERT查詢看起來有點怪異的日期（）函數。試試這個：

$date = date("Y-m-d"); 
"INSERT INTO `users` (id, username, password, email, ip, rank, reg_date) 
    VALUES (0, '$username', '$password', '$email', '$ip', 1, '".$date."')" 

編輯：腳本示例

<?php 
if(!isset($_POST['username'])||!isset($_POST['email'])||!isset($_POST['password']))//enter more values if necessary 
{ 
header("Location: error_page.php?error=1"); 
} 
else 
{ 
//do whatever, eg execute query 
} 
?>