将数据添加到注册表

好了，以便在制作基于pokemon浏览器的游戏过程中，即使在用户注册到我的网站时也会遇到麻烦，他们会获得他们选择的初学者口袋妖怪。除了它为用户提供宠物小精灵的部分之外，我拥有所有的工作，现在它将小宠物输入到数据库中，但它不会为注册它的用户赋予宠物小精灵空闲属性。有点难以解释。将数据添加到注册表

这是我的代码的一部分，它将数据输入到存储所有用户pokemon的表中。

<?php 

if ($_POST['starter'] == '1') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Bulbasaur','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '2') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Charmander','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '3') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Squirtle','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '4') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Chikorita','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '5') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Cyndaquil','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '6') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Totodile','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '7') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Treecko','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '8') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Torchic','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '9') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Mudkip','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '10') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Turtwig','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '11') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Chimchar','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '12') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Piplup','".$_SESSION['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 
?>

，我想不通的事情是如何使它因此它需要用户与注册名称，并把它在的地方。$ _ SESSION [“用户名”。我知道这是行不通的，因为这个人还没有登录，因为他们还在注册。

这是我的表格。

<form action="" method="post"> 
     <div align="center"> 
      <ul> 
      <p></p> 
       Username* <br> 
       <input type="text" name="username"> 

      <p></p> 
       Password*<br> 
       <input type="password" name="password"> 

      <p></p> 
       Password again*<br> 
       <input type="password" name="password_again"> 

      <p></p> 
       First name<br> 
       <input type="text" name="first_name"> 

      <p></p> 
       Last name<br> 
       <input type="text" name="last_name"> 

      <p></p> 
       Email*<br> 
       <input type="text" name="email"> 

      <p></p> 
       Starter*<br> 
       <select name="starter" id="" > 
       <option value="1">Bulbasaur</option> 
       <option value="2">Charmander</option> 
       <option value="3">Squirtle</option> 
       <option value="4">Chikorita</option> 
       <option value="5">Cyndaquil</option> 
       <option value="6">Totodile</option> 
       <option value="7">Treecko</option> 
       <option value="8">Torchic</option> 
       <option value="9">Mudkip</option> 
       <option value="10">Turtwig</option> 
       <option value="11">Chimchar</option> 
       <option value="12">Piplup</option> 
       </select> 

       <p></p> 
       <input type="submit" value="Register"> 

      </ul> 
      </div> 
     <ul> 
     </ul> 
</form>

对不起了巨大的问题，但任何帮助，将不胜感激:)

来源

2013-01-04 Sakai

循环。学习[loops]（http://php.net/language.control-structures）。和[数组]（http://php.net/language.types.array）。 *请*。它不会解决您的直接问题，但它会让您的代码更加简短，更轻松。另外：**单挑！** PHP的下一个主要版本是*弃用* mysql_'系列函数。因为你仍然在学习PHP，所以现在是[切换到PDO]（http://php.net/book.pdo）或[mysqli]（http://php.net/book.mysqli）的好时机。。 – Charles

我闻到版权侵犯:( – 2013-01-04 00:54:23

有很多在你的代码加以改进。但这是一个快速修复：

<?php 

if ($_POST['starter'] == '1') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Bulbasaur','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '2') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Charmander','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '3') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Squirtle','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '4') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Chikorita','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '5') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Cyndaquil','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '6') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Totodile','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '7') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Treecko','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '8') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Torchic','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '9') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Mudkip','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '10') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Turtwig','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '11') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Chimchar','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 

if ($_POST['starter'] == '12') { 
mysql_query("INSERT INTO user_pokemon 
(pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES('Piplup','".$_POST['username']."', 100,'".time()."','1' ,'5','Normal') 
") or die(mysql_error()); 
} 
?>

这假定您的帖子是从您的页面上的表单提交的。就像别人说的，学习PDO：http://php.net/manual/en/book.pdo.php

您当前的代码很容易受到SQL注入：http://en.wikipedia.org/wiki/SQL_injection

说不好。

来源

2013-01-04 01:03:24 Leng

非常感谢:)我通常有一个人帮助我保护我的代码和一切，但他们今天在这里，所以我自己去了，所以我开始学习，我会在我得到它的工作后修复一切。 – Sakai

@ user1908445不客气。 :) 这是一本很棒的书，如果你想快速学习：http://amzn.com/1449319262 – Leng

男人，真的看起来像你是PHP新手，所以让我提供一些建议。

在查询中使用$ _POST/$ _ GET值？不要这样做。永远不要相信用户。 Learn why.

你必须假设你的访问者是一个疯子连环杀手，拿出来摧毁你的应用程序。你必须防止它。

清理你的代码。正如其他人所建议的，循环/开关可能会帮助您
对于您的项目而言可能为时过早，但尝试移动OOP。（即使有时看起来像一个矫枉过正的缺点是低的优点有很多）

顺便说一句，这应该做的伎俩，利用PDO：

$dbh = new PDO('mysql:dbname=YOURDBNAME;host=localhost', $db_user, $db_passwd); 
// Get the choosen starter pokemon 
$starter = $_POST['starter']; 
$pokemons = array(
    1 => 'Bulbasaur', 
    2 => 'Charmander', 
    //[.. and so on..] 
); 

// check if choosed pokemon is available 
if(!in_array($starter, $pokemons)) 
{ 
    // Pokemon not available, throw exception, error, die(), whatever 
} 
else 
{ 
    // Insert the pokemn into the db 
    $insert = $dbh->prepare("INSERT INTO user_pokemon (pokemon, belongsto, exp, time_stamp, slot, level,type) VALUES (:pokemon, :user, 100,:time ,1, 5 ,'Normal')"); 

    $user_name = $_POST['username']; // what about check the username? Sanitization, etc.. 

    if($insert->execute(array(':pokemon' => $pokemons[$starter], ':user' => $user_name, ':time' => time()))) 
    { 
     // Success! 
    } 
    else 
    { 
     // Error! 
     $error = $insert->errorInfo(); 
     print_r("There was an error: \ncode: %s\nmessage:%s", $error[1], $error[2]); 
    } 
}

来源

2013-01-04 01:23:55 Strae

谢谢:)我想我必须去学习这个PDO，因为每个人似乎都认为它是需要的:) – Sakai

将数据添加到注册表

回答

相关问题