php - 如何在php mysql提交表单中停止自动乘法

Question

这段代码工作正常，但我的问题是，当我使用 php 提交(大小)行数据时，这段 php 代码会自动相乘并在 phpmyadmin 中提交，就像 350000

示例我提交一个表单并且(大小)行数据是

480 x 800 pixels, 4.3 inches (~217 ppi pixel density) Sensors: Accelerometer, proximity

当我检查 phpmyadmin (size) 行时，它会像这样自动相乘并提交 (size) 行数据

350000

我该如何解决这个问题请帮我解决这个问题

谢谢

这是php mysql表单数据提交代码

<?php
    /* 
     NEW.PHP
     Allows user to create a new entry in the database
    */

     // creates the new record form
     // since this form is used multiple times in this file, I have made it a function that is easily reusable
     function renderForm($model, $category, $weight,$size, $error)
     {
     ?>

     <?php 


     // if there are any errors, display them
     if ($error != '')
     {
     echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
     }
     ?> 

     <?php 
     }


     //This is the directory where images will be saved
    $target = "media/";
    $target = $target . basename( $_FILES['photo']['name']);

    //This gets all the other information from the form

    $photo=($_FILES['photo']['name']);
    //Writes the photo to the server
    if(move_uploaded_file($_FILES['photo']['tmp_name'], $target))
    {

    //Tells you if its all ok
    echo "<center>Photo ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory</center>";
    }


        //connect to database

         mysql_connect('localhost','root','password');
         mysql_select_db('price');



     // check if the form has been submitted. If it has, start to process the form and save it to the database
     if (isset($_POST['submit']))
     { 
     // get form data, making sure it is valid
     $model = mysql_real_escape_string(htmlspecialchars($_POST['model']));
     $category = mysql_real_escape_string(htmlspecialchars($_POST['category']));
     $weight = mysql_real_escape_string(htmlspecialchars($_POST['weight']));
     $size = mysql_real_escape_string(htmlspecialchars($_POST['size']));
     $entertainment = mysql_real_escape_string(htmlspecialchars($_POST['entertainment']));
     $price = mysql_real_escape_string(htmlspecialchars($_POST['price']));
     $date = mysql_real_escape_string(htmlspecialchars($_POST['date']));
     $photo = mysql_real_escape_string(htmlspecialchars($_FILES['photo']['name']));

     // check to make sure both fields are entered
     if ($model == '' || $category == '')
     {
     // generate error message
     $error = 'ERROR: Please fill in all required fields!';

     // if either field is blank, display the form again
     renderForm($model, $category, $weight, $size,$error);
     }
     else
     {
     // save the data to the database
      mysql_query("INSERT mprice SET model='$model', category='$category',  weight='$weight',  size='$size',  entertainment='$entertainment', price='$price', date='$date', photo='$photo'")
     or die(mysql_error()); 
     echo "<center>Done!</center>";
     // once saved, redirect back to the view page

     }
     }
     else
     // if the form hasn't been submitted, display the form
     {
     renderForm('','','','','','','','');
     }




    ?>

Answer 1

您遇到了 sql 注入(inject)。也就是说，您允许用户提交的代码在您的数据库服务器中运行。字符串 480 * 800 是代码，MySQL 服务器正在为您运行它。

这不是开放互联网上的一个很酷的功能。幸运的是，您的其中一排没有 ;DROP TABLE mprice; 加速度计，是吧？

请考虑使用绑定(bind)变量。如果将 MySQL API 升级到 mysqli_ 或 PDO，这是最容易做到的。