2012-12-15 113 views
-1

我的問題不是電子郵件成功發送,它是我的網站上的確認頁面。電子郵件已經發送給用戶,但是當他們點擊鏈接激活密碼時,它會將它們帶到一個確認頁面,它應該確認激活並註冊它們,但它根本沒有做任何事情。 IT只是顯示一個空白頁面,我甚至檢查了數據庫,沒有任何改變。我想要任何幫助,我也有下面的代碼。任何幫助都會很棒。電子郵件確認使用php

<?php 

include('sqlconfig.php'); 

// Connect to server and select databse. 
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB"); 

/* Confirmation Code */ 
$passkey=$_GET['passkey']; 
$tbl_name1="temp_users"; 

/*retrieve data */ 
$sql1="SELECT * FROM temp_users WHERE confirm='$passkey'"; 
$result1=mysql_query($sql1); 

if($result1){ 
$count=mysql_num_rows($result1); 

/*Fetch The data From the table */ 
if($count==1){ 
$rows=mysql_fetch_array($result1); 
$Email=$rows['email']; 
$First_Name=$rows['FirstN']; 
$Last_name=$rows['LastN']; 
$password=$rows['password']; 
$phone=$rows['phone']; 
$tbl_name2="users"; 

/*Insert data into new users table */ 
$sql2="INSERT INTO $tbl_name2(First Name, Last Name, Email, Password, phone)VALUES('$First_Name', '$Last_name', '$Email', '$password', '$phone')"; 
$result2=mysql_query($sql2); 
} 

/*If passkey is not found*/ 
else { 
echo "Wrong Confirmation code"; 
} 

/*If activation successful, show, and delete old data from temp table*/ 
if($result2){ 

echo "Your account has been activated"; 

// Delete information of this user from table "temp_members_db" that has this passkey 
$sql3="DELETE FROM $tbl_name1 WHERE confirm_code = '$passkey'"; 
$result3=mysql_query($sql3); 

} 


} 
?> 
+7

你是**敞開** SQL注入攻擊,和你**會如果你還沒有被黑客攻擊**。學習如何使用PDO或類似的準備好的查詢來完全避免這個問題。 – Brad

+1

空白頁不會說太多;添加'ini_set('display_errors','On'); error_reporting(-1);'在腳本的頂部並重試。 –

回答

0

嘗試。

如果($密鑰== NULL)//檢查密鑰是否爲空或不是,這可能是黑屏的原因

{ 回聲「頁上的無效動作」; // some error message }

else { $ flag = FALSE; //某處開始在腳本

/*retrieve data */ 
    $sql1="SELECT * FROM temp_users WHERE confirm='$passkey'"; 

    $result1=mysql_query($sql1); 

    if(mysql_num_rows($result1)) 
     { 
     $rows=mysql_fetch_array($result1); 
     $Email=$rows['email']; 
     $First_Name=$rows['FirstN']; 
     $Last_name=$rows['LastN']; 
     $password=$rows['password']; 
     $phone=$rows['phone']; 
     $tbl_name2="users"; 

     /*Insert data into new users table */ 
     $sql2="INSERT INTO $tbl_name2(First Name, Last Name, Email, Password, phone)VALUES('$First_Name', '$Last_name', '$Email', '$password', '$phone')"; 
     if(mysql_query($sql2)) 
      { 
      $flag = TRUE; 
      } 

     } 
    /*If passkey is not found*/ 
    else 
     { 
     echo "Wrong Confirmation code"; 
     } 

    /*If activation successful, show, and delete old data from temp table*/ 
    if($flag) 
     { 
     echo "Your account has been activated"; 
     // Delete information of this user from table "temp_members_db" that has this passkey 
     $sql3="DELETE FROM $tbl_name1 WHERE confirm_code = '$passkey'"; 
     $result3=mysql_query($sql3); 
     } 

}

的開頭第一個代碼將檢查是否有從查詢的到來,如果是,那麼它獲取數據,並插入到表2的任何結果。

引入一個新的變量標誌來檢查是否執行了query2,如果是,則執行查詢3。

編輯:先檢查密鑰今後是否包含一定的價值或沒有,如果沒有它顯示錯誤代碼否則其餘執行

+0

-1,這是一個原始代碼的複製和粘貼。你沒有解釋你改變了什麼,你爲什麼改變它,以及改變如何幫助。 – Charles

+0

@Charles我改變了代碼,當你想要一個描述時,我也添加了描述 – Dev

+0

非常感謝,我會嘗試一下代碼,看看,至於MySQL注入的東西,我沒有包括任何舊腳本,因爲這隻在我的電腦上運行,我只能訪問它。一旦我將其上傳到真實服務器,我一定會保護它。 – user1868065

1

沒有測試它當然需要做一些修改,但是:

<?php 

include('sqlconfig.php'); 

//Connect to Database 
$mysqli = new mysqli($hostname, $username, $password, $databasename); 
//PHP > 5.3.0 
if ($mysqli->connect_error) { 
    die('Connect Error (' . $mysqli->connect_errno . ') ' 
      . $mysqli->connect_error); 
} 

/* Confirmation Code */ 
$passkey = $_GET['passkey']; 
$tbl_name1 = "temp_users"; 


/* create a prepared statement */ 
if ($stmt = $mysqli->prepare("SELECT * FROM temp_users WHERE confirm=?")) { 

    $stmt->bind_param("s", $passkey); 
    $result = $stmt->get_result(); 

    $rows = $result->fetch_assoc(); 

    $stmt->close(); 

    $Email = $rows['email']; 
    $First_Name = $rows['FirstN']; 
    $Last_name = $rows['LastN']; 
    $password = $rows['password']; 
    $phone = $rows['phone']; 
    $tbl_name2 = "users"; 

    /* Create table doesn't return a resultset */ 
    if ($mysqli->query("INSERT INTO $tbl_name2(First Name, Last Name, Email, Password, phone)VALUES('$First_Name', '$Last_name', '$Email', '$password', '$phone')") === TRUE) { 
     echo "Your account has been activated"; 

     if ($stmt = $mysqli->prepare("DELETE FROM $tbl_name1 WHERE confirm_code = ?")) { 
      $stmt->bind_param("s", $passkey); 
      $stmt->execute(); 
      $stmt->close(); 
     } 
    } 
    else { 
     echo "Wrong Confirmation code"; 
    } 
} 

注:在選擇查詢中使用的$_GET['passkey']價值時,我們使用bind_param避免SQL注入。

強烈推薦這個閱讀:http://php.net/manual/en/faq.databases.php#faq.databases.mysql.deprecated

+0

你沒有解釋你改變了什麼,爲什麼改變它,以及改變如何幫助。轉換到mysqli讓你一勞永逸,但仍然,來吧。 – Charles

+0

我已經改變了一切,因爲給我們的信息,很難知道錯誤在哪裏... – cheesemacfly

+0

感謝您的幫助,我會試試 – user1868065