PHPのSQLインサートが動作しません

Question

私は非常にphpの新しいと登録を取得しようとすると、私のコードは分だけで、データベースにユーザー名をロードして何もありません。これは、SQL INSERT INTO Iハードコードそれらとところで、私は、これはひどいコードとパスワードを知っている

$users_Password 

などを使用してはいけないが、などをハッシュ化する必要がありますが、IVEは文字通り引き裂いた場合は、データベースの他のフィールドに値を入力していますがこのコードは、この文句を言わない仕事は、これは、選別された後、歓声に戻ってすべてのものを追加します、これはRegister.phpファイルで、その後私のコード

フォーム

<form id = "Register_form" action="Register.php" method="post"> 
      Username: <input type="text" name="Username"><br> 
      Password: <input type="password" name="Password"><br> 
      Confirm Password: <input type="password" name="ConfirmPassword"><br> 
      First Name: <input type="text" name="FirstName"><br> 
      Surname: <input type="text" name="Surname"><br> 
      Address Line 1: <input type="text" name="AddressLine1"><br> 
      Address Line 2: <input type="text" name="AddressLine2"><br> 
      City: <input type="text" name="City"><br> 
      Telephone: <input type="text" name="Telephone"><br> 
      Mobile: <input type="text" name="Mobile"><br></br> 
      <input type="submit"> 

で離れているため

<?php 
       // create connection 
       $con=mysqli_connect("localhost","root","","book"); 
       // check connection 
       if(mysqli_connect_errno($con)){ 
        echo "Failed to connect to MySQL: " . mysqli_connect_error(); 
       } 

       $users_Username = $_POST['Username']; 
       $users_Password = $_POST['Password']; 
       $users_ConfirmPassword = $_POST['ConfirmPassword']; 
       $users_FirstName = $_POST['FirstName']; 
       $users_Surname = $_POST['Surname']; 
       $users_AddressLine1 = $_POST['AddressLine1']; 
       $users_AddressLine2 = $_POST['AddressLine2']; 
       $users_City = $_POST['City']; 
       $users_Telephone = $_POST['Telephone']; 
       $users_Mobile = $_POST['Mobile']; 
       //Multiple Error checkings such as 
       if ($users_Username == "") 
       { 
        echo "Please enter a username"; 
        echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
       } 
       else if ($users_Password = "") 
       { 
        echo "Please enter a password"; 
        echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
       } 
       else if ($users_ConfirmPassword == $users_Password) 
       { 
        if (strlen($users_Password)<=6) 
        { 
         $sql = "INSERT INTO users VALUES ('$users_Username', '$users_Password', '$users_FirstName', '$users_Surname','$users_AddressLine1','$users_AddressLine2','$users_City','$users_Telephone','$users_Mobile')"; 

         if($con->query($sql) === TRUE) 
         { 
          echo "User succesfully registered"; 
          echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Log_In_Screen.php';\",1500);</script>"; 


         } 
         else 
         { 
          echo "Unable to register user, Please try again"; 
          echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
         } 

         //echo "<pre>\n$sql\n</pre>\n"; 
         mysql_query($sql); 
        } 
        else 
        { 
         echo "The password you entered is too long, max characters is 6"; 
         echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
        } 
       } 
       else 
       { 
        echo "Passwords do not match, Please try again"; 
        echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
       } 

       mysqli_close($con); 

     ?> 

ユーザー名以外のデータベースには何も挿入されないようですが、これを修正する方法はありますか？ 乾杯お待ちください

Answer 1

あなたのデータベースにはどんなコンテンツがありますか？

適切なラインで次のように試してみてください：あなたは文字列の連結を使用する必要がありますので

"INSERT INTO users VALUES ('".$users_Username."', '".$users_Password."', '".$users_FirstName."', '".$users_Surname."','".$users_AddressLine1."','".$users_AddressLine2."','".$users_City."','".$users_Telephone."','".$users_Mobile."')"; 

PHP paramsが「」で評価され傾けます。

Answer 2

あなたはどこにいても、mysqlとmysqliを混合していましたが、あなたは自分自身をSQLインジェクションのために広く開いていました。スクリプトを使用して私はmysqliにつきました。prepared statementsを使用し、検証と永続性を分割しました。このうちのいくつかを説明するコメントがあります

<?php 
    $users_Username = $_POST['Username']; 
    $users_Password = $_POST['Password']; 
    $users_ConfirmPassword = $_POST['ConfirmPassword']; 
    $users_FirstName = $_POST['FirstName']; 
    $users_Surname = $_POST['Surname']; 
    $users_AddressLine1 = $_POST['AddressLine1']; 
    $users_AddressLine2 = $_POST['AddressLine2']; 
    $users_City = $_POST['City']; 
    $users_Telephone = $_POST['Telephone']; 
    $users_Mobile = $_POST['Mobile']; 

    //LETS JUST DO ERROR CHECKING ONLY 
    $valid = true; //Used to verify that user input is as expected. 
    //All the validation as before just as ifs and will set the 
    //$valid flag to false when validation fails. 
    if ($users_Username == "") 
    { 
     $valid = false; 
     echo "Please enter a username"; 
     echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
    } 
    if ($users_Password = "") 
    { 
     $valid = false; 
     echo "Please enter a password"; 
     echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
    } 
    if (strlen($users_Password)>6) 
    { 
     $valid = false; 
     echo "The password you entered is too long, max characters is 6"; 
     echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
    } 

    if ($users_ConfirmPassword != $users_Password) 
    { 
     $valid = false; 
     echo "Passwords do not match, Please try again"; 
     echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Register_Form.php';\",1500);</script>"; 
    } 

    //Separating validation and persistence mean you only 
    //open a connection and persist when needed. 
    if($valid) 
    { 
     //NOW WE ONLY CONNECT WHEN YOU NEED TO!     
     $con=mysqli_connect("localhost","root","","book"); 

     // check connection 
     if(!$con) 
     { 
      echo "Failed to connect to MySQL: " . mysqli_connect_error(); 
     } 
     //YOU MAY NEED TO SPECIFY THE COLUMNS YOU ENTER 
     $stmt = mysqli_prepare($con, "INSERT INTO users VALUES (?,?,?,?,?,?,?,?,?)"); 
     //ASSUMING ALL 9 PARAMETERS ARE STRINGS hence the sssssssss 
     mysqli_stmt_bind_param($stmt, 'sssssssss', $users_Username,$users_Password,$users_FirstName,$users_Surname,$users_AddressLine1,$users_AddressLine2,$users_City,$users_Telephone,$users_Mobile); 

     if(mysqli_stmt_execute($stmt)) 
     { 
      echo "User succesfully registered"; 
      echo "<script>setTimeout(\"location.href = 'http://localhost/webD/Assignment/Log_In_Screen.php';\",1500);</script>"; 
     } 

     mysqli_close($con); 
    } 
?>