页面加载时间过长

Question

我发现很难理解为什么我的一个页面在显示其内容之前需要很长时间。该页面上的代码如下。

请告诉可能是错误的，如果代码是安全的。如果不是如何解决它。

<?php 

//open database 
    include("includes/db_connect.php"); 
//require("includes/mysql_conn.php"); 

    // Check to see if the type of file uploaded is a valid image type ......................... 
function is_valid_type($file) 
{ 
    // This is an array that holds all the valid image MIME types 
    // These are the same for all file upload boxes 
    $valid_types = array("image/jpg", "image/jpeg", "image/bmp", "image/gif"); 

    // This is an array that holds all valid image extensions 
    // These are the same for all file upload boxes 
    $valid_exts = array('jpg', 'jpeg', 'bmp', 'gif'); 

    // This check is optional 
    if(!in_array($file['type'], $valid_types)) 
     return 0; 

    // Get the extension from the uploaded filename 
    $upload_ext = pathinfo($file['name'], PATHINFO_EXTENSION); 

    // This check is essential for security 
    if(!in_array($upload_ext, $valid_exts)) 
     return 0; 

    return 1; 
} 
//...................................................................................................  
    // Just a short function that prints out the contents of an array in a manner that's easy to read 
    // I used this function during debugging but it serves no purpose at run time for this example 
    function showContents($array) 
    { 
     echo "<pre>"; 
     print_r($array); 
     echo "</pre>"; 
    } 

    // Set some constants 

    // This variable is the path to the image folder where all the images are going to be stored 
    // Note that there is a trailing forward slash 
    $TARGET_PATH = "images/"; 

    // Get our POSTed variables 
    $ctitle = $_POST['ctitle']; 
    $csubject = $_POST['csubject']; 
    $creference = $_POST['creference']; 
    $cyear = $_POST['cyear']; 
    $cobjecttype = $_POST['cobjecttype']; 
    $cmaterial = $_POST['cmaterial']; 
    $ctechnic = $_POST['ctechnic']; 
    $cwidth = $_POST['cwidth']; 
    $cheight = $_POST['cheight']; 
    $cperiod = $_POST['cperiod']; 
    $cmarkings = $_POST['cmarkings']; 
    $cdescription = $_POST['cdescription']; 
    $csource = $_POST['csource']; 
    $cartist = $_POST['cartist']; 
    $image = $_FILES['image']; 

// Build our target path full string. This is where the file will be moved do 
// i.e. images/picture.jpg 
$target_path_1 = $TARGET_PATH . $image['name']; 

    // Sanitize our inputs 
    $ctitle = mysql_real_escape_string($ctitle); 
    $csubject= mysql_real_escape_string($csubject); 
    $creference = mysql_real_escape_string($creference); 
    $cyear = mysql_real_escape_string($cyear); 
    $cobjecttype = mysql_real_escape_string($cobjecttype); 
    $cmaterial = mysql_real_escape_string($cmaterial); 
    $ctechnic = mysql_real_escape_string($ctechnic); 
    $cwidth = mysql_real_escape_string($cwidth);  
    $cheight = mysql_real_escape_string($cheight); 
    $cperiod = mysql_real_escape_string($cperiod); 
    $cmarkings = mysql_real_escape_string($cmarkings); 
    $cdescription = mysql_real_escape_string($cdescription); 
    $csource = mysql_real_escape_string($csource); 
    $cartist = mysql_real_escape_string($cartist); 
    $image['name'] = mysql_real_escape_string($image['name']); 

    // Make sure all the fields from the form have inputs 
    if ($ctitle == "" || $csubject == "" || $creference == "" || $cyear == "" || $cobjecttype == "" || $cmaterial == "" || $ctechnic == "" || $cwidth == "" || $cheight == "" || $cperiod == "" || $cmarkings == "" || $cdescription == "" || $csource == "" || $cartist == "" || $image['name'] == "") 
    { 
     echo "All fields are required"; 

     exit; 
    } 

// Check to make sure that our file is actually an image 
// You check the file type instead of the extension because the extension can easily be faked 
if (!is_valid_type($image)) 
{ 
     echo "You must upload a jpeg, gif, or bmp"; 

     exit; 
} 

// Here we check to see if a file with that name already exists 
// You could get past filename problems by appending a timestamp to the filename and then continuing 
if (file_exists($target_path_1)) 
{ 
     echo "A file with that name already exists"; 

     exit; 
} 

// Lets attempt to move the file from its temporary directory to its new home 
if (
    move_uploaded_file($image['tmp_name'], $target_path_1) 
) 
{ 
     // NOTE: This is where a lot of people make mistakes. 
     // We are *not* putting the image into the database; we are putting a reference to the file's location on the server 
     $sql = "insert into collections (ctitle, csubject, creference, cyear, cobjecttype, cmaterial, ctechnic, cwidth, cheight, cperiod, cmarkings, cdescription, csource, cartist, cfilename) values ('$ctitle', '$csubject', '$creference', '$cyear', '$cobjecttype', '$cmaterial', '$ctechnic', '$cwidth', '$cheight', '$cperiod', '$cmarkings', '$cdescription', '$csource', '$cartist', '" . $image['name'] . "')"; 
     $result = mysql_query($sql) or die ("Could not insert data into DataBase: " . mysql_error()); 

     exit; 
} 
else 
{ 
     // A common cause of file moving failures is because of bad permissions on the directory attempting to be written to 
     // Make sure you chmod the directory to be writeable 

     echo "Could not upload file. Check read/write persmissions on the directory"; 

     exit; 
} 
    ?> 

我的数据库连接代码：

<?php 
//set connection variables 
$host = "localhost"; 
$username = "joseph"; 
$password = ""; 
$db_name = "collectionsdb"; //database name 

//connect to mysql server 
$mysqli = new mysqli($host, $username, $password, $db_name); 

//check if any connection error was encountered 
if(mysqli_connect_errno()) { 
    echo "Error: Could not connect to database."; 
    exit; 
} 
?> 

感谢名单。

约瑟夫

Answer 1

对我来说似乎很好。

有三个阶段。

• 时间上传数据（取决于文件大小和连接速度）
• 连接到数据库（取决于负载的数据库服务器上）
• 和文件服务器上的活动（取决于在您的服务器的负载）...

如果您在本地测试系统也可能有病毒扫描干扰以及。首先过滤发布的数据，然后扫描文件并在移动时再次扫描文件（是的，它们可能非常偏执......）。

建议：放一些“print_r（microtime（））;”在那里看一看。

Answer 2

该代码不一定安全。 Sql注入的东西，我很容易发现。不要像这样将变量传递到查询字符串中。尽管您使用的是mysql_real_escape_string()，但有些情况并不适合。

请使用参数化查询。你也应该担心插入你的数据库的HTML标记可能被用于XSS。

另一点要记住的是你上传文件夹的权限。确保你没有每个人都读写。

希望它有帮助。

有关缓慢加载根本原因的其他信息，请参阅我的评论。