请有人可以解释为啥我在下面收到错误消息？

Posted 2023-02-24

【中文标题】请有人可以解释为啥我在下面收到错误消息？

【英文标题】：Please can someone explain why im getting an error message below?请有人可以解释为什么我在下面收到错误消息？

【发布时间】：2017-03-17 13:30:53

【问题描述】：

$check_day = "select * from timetable where day ='$day'";
$run = mysql_query($check_day);
if(mysql_num_rows($run) > 0) 
  echo "<script>alert('day $day already exists in our database, please try another one!')</script>";
  exit();


$query = "insert into timetable (classes, courses, lecturers, time, room, day) values ('$classes','$courses','$lecturers','$time','$room','$day')";
if (mysql_query($query)) 
  echo "<script>alert('Registration Successful!')</script>";

【问题讨论】：

您遇到的错误是什么？

Little Bobby 说 your script is at risk for SQL Injection Attacks.。即使escaping the string 也不安全！ SQL 注入！ 不再只是早餐！

请stop using mysql_* functions。 These extensions 已在 php 7 中删除。了解prepared 的 PDO 和 @987654328 语句@ 并考虑使用 PDO，it's really pretty easy。

@felixN 你的代码可能会被 SQL 注入攻击，不要这样写代码***.com/questions/601300/what-is-sql-injection

@JohnConde 保留字是什么？ time 和 day 是关键字，但不是保留的。

【参考方案1】：

    /* As I read all the previous comments and find out that you are using old SQL query. which is a bad practice. */

    # Note: Please read what is mysqli, why we use mysqli

    # I have correct your query 



 // Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) 
    die("Connection failed: " . mysqli_connect_error());



      $check_day = "SELECT * FROM timetable WHERE day ='".$day."'";

    $run = mysqli_query($conn,$check_day);

    if(mysqli_num_rows($run) >0) 

        echo "<script>alert('day $day already exists in our database, please try another one!')</script>";
            exit();
    else

    $query = "INSERT INTO timetable (`classes`, `courses`, `lecturers`, `time`, `room`, `day`) VALUES ('".$classes."','".$courses."','".$lecturers."','".$time."','".$room."','".$day."')";

    if(mysqli_query($conn,$query))
                echo "<script>alert('Registration Successful!')</script>";
    

    

希望对你有帮助

【参考方案2】：

您正在使用过时的 PHP/MySQL 函数。

使用新的mysqli_* 函数，因为它们更安全且更新。

https://www.w3schools.com/php/php_ref_mysqli.asp

【参考方案3】：

使用 mysqli 更安全更好。

第一次连接：$db = mysqli_connect('host', 'user', 'password', 'database');

接下来我们要进行查询：

$query = "insert into timetable (classes, courses, lecturers, time, room, day) values ('$classes','$courses','$lecturers','$time','$room','$day')";
$result = mysqli_query($db, $query);

现在您的查询已添加，您可以提供额外的操作：

//Your extra code here