2010-11-18 62 views
-1

我创建了一个使用php,mysql和html进行任务管理的网页。 我在哪里填写html页面并将其存储在mysql数据库中。另外,列出分配给的任务。 我有一个状态下拉列表(即 - 新的,接受的,拒绝的,完成的)。 我想在完成或接受我的用户并关闭时更新状态中的更改。 请帮助我。使用php和mysql更改状态

这是php和mysql脚本。如果我犯了错误,请告诉我。

============================================== =

<?php 

$months= array("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"); 
$years = array(2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020); 
$statuses= array("New","Accepted","Rejected","Started","Done","Verified"); 
if(!empty($_POST["submit"])) 
    { 
    $taskname =$_POST['taskN']; 
    $description = $_POST['desc']; 
    $status = $_POST['status1']; 
    $firstname = $_POST['fname']; 
    $lastname = $_POST['lname']; 
    $email = $_POST['email1']; 

    $month_task = $_POST['month']; 
    $dt=$_POST['date']; 
    $year_task=$_POST['year']; 
    $dateProposed="$month_task/$dt/$year_task"; 
    $month=$_POST['month1']; 
    $date=$_POST['day']; 
    $year=$_POST['year1']; 
    $dateCompletion="$month/$date/$year"; 
    $requestorFN = $_POST['requestorfn']; 
    $requestorLN = $_POST['requestorln']; 

    $emailAddress = $_POST['email']; 
if(empty($taskname)){$msg .= "You did not enter the title<br />";} 
if(empty($description)){$msg .= "You did not enter the description<br />";} 
if(empty($requestorFN)){$msg .= "You did not enter the name<br />";} 
if(empty($requestorLN)){$msg .= "You did not enter the name<br />";} 
if(empty($emailAddress)){$msg .= "You did not enter the email adreess<br />";} 
if(empty($status)){$msg .= "You did not select a priority<br />";} 
if(empty($dateProposed)){$msg .= "You did not enter the date of submission<br />";} 
if(empty($firstname)){$msg .= "You did not enter the name<br />";} 
if(empty($lastname)){$msg .= "You did not enter the name<br />";} 
if(empty($email)){$msg .= "You did not enter the email address<br />";} 
if(empty($dateCompletion)){$msg .= "You did not enter the completion date";} 

if(empty($msg)) 
{ 

    $dbc = mysqli_connect('localhost','divya', 'All4Y0u!', 'ic4d') or die('Error connecting to MySQL server.'); 


    $query = "INSERT INTO Assign_Tasks (taskname,description ,status,firstname,lastname,email,dateProposed, dateCompletion,requestorFN,requestorLN,emailAddress) "."VALUES ('$taskname','$description','$status','$firstname','$lastname','$email','$dateProposed','$dateCompletion','$requestorFN','$requestorLN', '$emailAddress')"; 


$result = mysqli_query($dbc, $query) or die('Error querying database.'); 

mysqli_close($dbc); 

} 
} 
?> 

<html> 
<head> 
<title> Submit Task </title> 
</head> 
<body> 
<form action="#" name="form" method="post"> 
(*) required fields <br> 
<br> 
<br> 
<br> 
Task Title: * <br> 
<textarea name="taskN" cols=50 rows=2><?php echo $taskname; ?></textarea> 
<br> 
<br> 
Task Description: *<br> 
<textarea name="desc" cols=50 rows=10><?php echo $description; ?></textarea> 
<br> 
<br> 

Priority Level:*<br> <select name="status1"> 
<option value=""></option > 
<?php 
for($i=0;$i<count($statuses);$i++) 
{ 
if($status == $statuses[$i]){echo "<option value='{$statuses[$i]}' selected> {$statuses[$i]} </option>";} 
else{echo "<option value='{$statuses[$i]}'> {$statuses[$i]} </option> ";} 
} 
?> 
</select> 
<br> 
<br> 
First Name:* 
<textarea name="fname" cols=30 rows=2><?php echo $firstname; ?></textarea> 
<br> 
<br> 
Last name:* 
<textarea name="lname" cols=30 rows=2><?php echo $lastname; ?></textarea> 
<br> 
<br> 

Developer Email:* 
<textarea name="email1" cols=30 rows=2><?php echo $email; ?></textarea> 
<br> 
<br> 

Date of Submission: * 
<br> 
<br> 
Month <select name="month"> 
<option value=""></option > 
<?php 
for($i=0;$i<count($months);$i++) 
{ 
if($month_task == $months[$i]){echo "<option value='{$months[$i]}' selected> {$months[$i]} </option >";} 
else{echo "<option value='{$months[$i]}'> {$months[$i]} </option >";} 
} 
?> 
</select> 
Day: <select name="date"> 
<option value=""></option > 
<?php 
    for($i=1;$i<=31;$i++) 
{ 
if($dt == $i){echo "<option value='$i' selected> $i </option >";} 
else{echo "<option value='$i'> $i </option >";} 
} 
?> 
</select> 

Year: <select name="year"> 
<option value=""></option > 
<?php 
for($i=0;$i<count($years);$i++) 
{ 
if($year_task == $years[$i]){echo "<option value='{$years[$i]}' selected> {$years[$i]} </option >";} 
else{echo "<option value='{$years[$i]}'> {$years[$i]} </option >";} 
} 
?> 
</select> 
<br> 
<br> 
Requested Date of Completion:* 
<br> 
<br> 
Month <select name="month1"> 
<option value=""></option > 
<?php 
for($i=0;$i<count($months);$i++) 
{ 
if($month == $months[$i]){echo "<option value='{$months[$i]}' selected> {$months[$i]} </option >";} 
else{echo "<option value='{$months[$i]}'> {$months[$i]} </option >";} 
} 
?> 
</select> 
Day: <select name="day"> 
<option value=""></option > 
<?php 
for($i=1;$i<=31;$i++) 
{ 
if($date == $i){echo "<option value='$i' selected> $i </option >";} 
else{echo "<option value='$i'> $i </option >";} 
} 
?> 
</select> 
Year: <select name="year1"> 
<option value=""></option > 
<?php 
for($i=0;$i<count($years);$i++) 
{ 
if($year == $years[$i]){echo "<option value='{$years[$i]}' selected> {$years[$i]} </option >";} 
else{echo "<option value='{$years[$i]}'> {$years[$i]} </option >";} 
} 
?> 
</select> 
<br> 
<br> 
Requestor:* 
<textarea name="requestorfn" cols=30 rows=2><?php echo $requestorFN; ?></textarea> 
<br> 
<br> 
Requestor:* 
<textarea name="requestorln" cols=30 rows=2><?php echo $requestorLN; ?></textarea> 
<br> 
<br> 

Requestor Email Address:* 
<textarea name="email" cols=40 rows=2><?php echo $emailAddress; ?></textarea> 
<br> 
<br> 
<input type="submit" name="submit" value="Submit"> 
<input type="reset" onClick="return confirm('Are you sure you want to reset the form?')" value="Reset"> 
<input type="button" name="Cancel" value="Cancel" onClick="window.location='https://fenris.nws.noaa/dokuwiki/doku.php?id=developer_pages:ic4d_project_pages:main '"/> 
</form> 
<div id="msg" style="position:absolute;top:200px;left:500px;color:#f00;padding:10px;border:3px solid #f00;display:none;"><?php echo $msg; ?><p><button onclick="document.getElementById('msg').style.display = 'none'">Close</button></div> 

<?php 
if(!empty($msg)){echo "<script>document.getElementById('msg').style.display = 'block'</script>";} 
?> 

</body> 
</html> 
+0

我固定尽可能多的格式,我可以。我已经将它添加到代码块中;如果您希望人们通读您的代码,请修复缩进 - 这将使您更有可能获得有用的帮助。 – JAL 2010-11-18 20:51:01

+0

嗨wajiw,谢谢你的回复。你能告诉我在哪里可以找到我的脚本中的代码块?我是堆栈溢出新手。你能告诉我说明吗? – user512698 2010-11-19 13:25:31

回答

2

你的代码中最大的一个错误就是它对SQL注入缺陷极其脆弱。任何将POST输入之一更改为非SQL安全字符串的用户都可以非常轻松地破坏数据库。

https://stackoverflow.com/search?q=sql+injection

下一个最大的问题是,你是不是在输出excaping HTML字符,使得它琐碎引入跨站点脚本(XSS)攻击。

我强烈建议你阅读OWASP Top 10 Security Flaws,这样你就可以理解你犯的基本错误。

+1

也指向http://bobby-tables.com/。 – 2010-11-18 22:31:17