PHP數據庫連接失敗

Question

我有一個php文件，其中包含兩個函數，一個連接數據庫，一個設置爲購物車烹飪。這是該文件：

<?php 
$dbServer="localhost"; 
$dbName="test"; 
function ConnectToDb($server, $database){ 
    $s=@mysql_connect($server); 
    $d=@mysql_select_db($database, $s); 
    if(!$s || !$d) 
    return false; 
    else 
    return true; 
} 

function GetCartId(){ 
    if(isset($_COOKIE["cartId"])){ 
    return $_COOKIE["cartId"]; 
} 
else { 
    session_start(); 
    setcookie("cartId", session_id(), time()+((3600*24)*30)); 
    return session_id(); 
} 
} 
?> 

連接到數據庫的功能在另一個php文件中適用於此特定程序。我有這個文件出了問題：

<?php 
include("db.php"); 

    switch($_GET["action"]) { 
      case "add_item": 
      { 
        AddItem($_GET["id"], $_GET["qty"]); 
        ShowCart(); 
      break; 
      } 
      case "update_item": { 
        UpdateItem($_GET["id"], $_GET["qty"]); 
        ShowCart(); 
      break; 
      } 
      case "remove_item": { 
        RemoveItem($_GET["id"]); 
        ShowCart(); 
      break; 
      } 
      default: { 
        ShowCart(); 
      } 
    } 

    function AddItem($itemId, $qty) { 
      // Will check whether or not this item 
      // already exists in the cart table. 
      // If it does, the UpdateItem function 
      // will be called instead 


      $cxn = @ConnectToDb($dbServer, $dbName); 
      // Check if this item already exists in the users cart table 
      $result = mysql_query("select count(*) from cs368_cart where cookieID = '" . GetCartID() . "' and itemId = $itemId"); 
      $row = mysql_fetch_row($result); 
      $numRows = $row[0]; 

      if($numRows == 0) { 
        // This item doesn't exist in the users cart, 
        // we will add it with an insert query 
        @mysql_query("insert into cs368_cart(cookieID, itemId, qty) values('" . GetCartID() . "', $itemId, $qty)"); 
      } 
      else { 
        // This item already exists in the users cart, 
        // we will update it instead 

        UpdateItem($itemId, $qty); 
        } 
      } 

    function UpdateItem($itemId, $qty) { 
      // Updates the quantity of an item in the users cart. 
      // If the qutnaity is zero, then RemoveItem will be 
      // called instead 

      $cxn = @ConnectToDb($dbServer, $dbName); 

      if($qty == 0) { 
        // Remove the item from the users cart 
        RemoveItem($itemId); 
      } 
      else { 
        mysql_query("update cs368_cart set qty = $qty where cookieID = '" . GetCartID() . "' and itemId = $itemId"); 
        } 
      } 

    function RemoveItem($itemId) { 
      // Uses an SQL delete statement to remove an item from 
      // the users cart 
      $cxn = @ConnectToDb($dbServer, $dbName); 
      mysql_query("delete from cs368_cart where cookieID = '" . GetCartID() . "' and itemId = $itemId"); 
    } 

    function ShowCart() { 
      // Gets each item from the cart table and display them in 
      // a tabulated format, as well as a final total for the cart 
      $cxn = @ConnectToDb($dbServer, $dbName); 
      $result = mysql_query("select * from cs368_cart inner join cs368_products on cart.itemId = 
        items.itemId where cart.cookieID = '" . GetCartID() . "' order by items.itemName asc") 
        or die("Query to get test in function ShowCart failed with error: ".mysql_error()); 
?> 

我能做些什麼補救這個問題？謝謝！

Answer 1

首先：丟失@，並在其中放置一些適當的錯誤處理（當出現錯誤時這些函數返回false，並且可以使用mysql_error和mysql_errno來記錄它）。

第二：在有人通過URL偷偷摸摸一些額外的代碼之前，在這些$ _GET參數上使用了mysql_real_escape_string和intval。

第三：您正在訪問$ dbServer和$ dbName作爲函數UpdateItem的局部變量，而不是全局腳本。你應該只連接數據庫一次（在原始的db.php文件中），並讓查詢功能照顧其餘的（因爲只有一個連接，它們都默認爲那個）。