60. MySQLi 扩展拾遗

最新推荐文章于 2021-01-28 19:10:37 发布

enlyhua

最新推荐文章于 2021-01-28 19:10:37 发布

阅读量561

点赞数 1

分类专栏： PHP 文章标签：扩展 mysqli

本文链接：https://blog.csdn.net/enlyhua/article/details/49848749

版权

PHP 专栏收录该内容

158 篇文章 0 订阅

订阅专栏

1.验证是否开启 mysqli :
这里写图片描述

//1. phpinfo()

//2.检测模块是否加载extension_loaded('mysqli');

//3.检测函数是否存在  function_exists('mysqli_connect');

//4.得到当前已经开启的模块 get_loaded_extensions()

用户列表的实现：

userList.php

<?php
header('Content-Type:text/html;charset=utf-8');
$mysqli =new MySQLi('localhost','root','123456','test');
if($mysqli->connect_error){
    die('连接错误' . $mysqli->connect_error);
}

$sql = "select * from user2";

$result = $mysqli->query($sql);

if(!$result){
    die("查询错误" . $mysqli->error);
}

while($row = $result->fetch_row()){
    $rows[] = $row;  //将查到的数据封装到数组里面
}
var_dump($rows);
?>

<html>
<head>
    <meta http-equiv="content-type" content="text/html;charset=utf-8"/>
</head>

<body>
<h2>用户列表 -- <a href="addUser.php">添加用户</a></h2>
<table border="1" cellspacing="0" cellpadding="0" width="80%">
    <tr>
        <td>编号</td>
        <td>用户名</td>
        <td>年龄</td>
        <td>操作</td>
    </tr>
    <?php foreach($rows as $row):?>
        <tr>
            <td><?php echo $row[0];?></td>
            <td><?php echo $row[1];?></td>
            <td><?php echo $row[2];?></td>
            <td><a href="editUser.php">更新</a>|<a href="doAction.php?act=delUser&id=<?php echo $i;?>">删除</a></td>
        </tr>
    <?php endforeach;?>
</table>
</body>
</html>

这里写图片描述

添加用户：

addUser.php

<html>
<head>
    <meta http-equiv="content-type" content="text/html;charset=utf-8"/>
</head>

<body>
<h2>添加用户</h2>
<form action="doAction.php?act=addUser" method="post">
    <table>
        <tr>
            <td>ID</td>
            <td> <input type="number" name="id" id="" placeholder="请输入用户名ID" required="required"/> </td>
        </tr>
        <tr>
            <td>用户名</td>
            <td> <input type="text" name="username" id="" placeholder="请输入用户名" required="required"/> </td>
        </tr>
        <tr>
            <td>年龄</td>
            <td> <input type="number" min="1" max="100" name="age" id="" placeholder="请输入年龄" required="required"/> </td>
        </tr>
        <tr>
            <td colspan="2"><input type="submit" value="添加用户"/></td>
        </tr>
    </table>
</form>
</body>
</html>

doAction.php

<?php
//添加用户
header('Content-Type:text/html;charset=utf-8');
$mysqli = new MySQLi('localhost','root','123456','test');

if($mysqli->connect_error){
    die("连接错误" . $mysqli->connect_error);
}

$mysqli->set_charset('utf8');

$id = $_POST['id'];
$username = $_POST['username'];
$username = $mysqli->escape_string($username);//转义输入的特殊字符
$age = $_POST['age'];

$act = $_GET['act'];//根据不同操作完成不同功能

switch($act)
{
    case 'addUser':
        //echo '添加用户';
        $sql = "insert into user2(id,username,age) values('{$id}','{$username}','{$age}')";
        $res = $mysqli->query($sql);
        if($res){
            $insert_id = $mysqli->insert_id;
            echo "<script type='text/javascript'>
                  alert('添加成功，网站的第{$insert_id}位用户');
                  location.href = 'userList.php';
                  </script>";
        }else{
            echo $mysqli->error;
            echo "<script type='text/javascript'>
                  alert('添加失败');
                  location.href = 'addUser.php';
                  </script>";
        }
        break;
case 'delUser':
        echo '删除记录' . $id;
        $sql = "select from user where id=" . $id;
        $res = $mysqli->query($sql);
        if($res){
            $mes = '删除成功';
        }else{
            $mes = '删除失败';
        }
    $url = 'userList.php';
        echo "<script type='text/javascript'>
                  alert('{$mes}');
                  location.href = '{$url}';
              </script>";
        break;
}

sql 注入：

登陆页面：

<html>
<head>
    <meta http-equiv="content-type" content="text/html"/>
</head>

<body>
<form action="login.php" method="post">
    username:<input type="text" name="username" id=""/><br/>
    password:<input type="password" name="password" id=""/><br/>
    <input type="submit" value="登陆"/>
</form>
</body>
</html>

处理页面：

<?php

$mysqli = new MySQLi('localhost','root','123456','test');

if($mysqli->connect_error){
    die('connect error' . $mysqli->connect_error);
}

$mysqli->set_charset('utf8');

$username = $_POST['username'];
$password = $_POST['password'];

$sql = "select * from user1 where name='{$username}' and password='{$password}'";

$mysqli_result = $mysqli->query($sql);
//var_dump($mysqli_result);die();
if($mysqli_result){
    echo 'Ok';
}else{
    echo 'No' . $mysqli->error;
}

用户名输入：  ' or 1=1 #    就可以通过验证

enlyhua

关注

1
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
60. MySQLi 扩展拾遗

1.验证是否开启 mysqli : //1. phpinfo()//2.检测模块是否加载extension_loaded('mysqli');//3.检测函数是否存在 function_exists('mysqli_connect');//4.得到当前已经开启的模块 get_loaded_extensions()用户列表的实现：<?phpheader('Content-Type:text/ht
复制链接

扫一扫

专栏目录