blocks|key|1792406|text|if(+$username+==+''+%7C%7C+$pword+==+''+%7C%7C+$fname+==+''+%7C%7C+$lname+==+''+%7C%7C+$email+==+'')|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1792407|您正在通过执行$var+=+""为变量分配一个空空间，而不是与比较运算符$var+==+''或更严格的$var+===+''进行比较。|unstyled|offset|length|style|CODE|1792408|这将是一个更清晰的代码来遵循和维护：|1792409|function+sqlEscape($string){
++++return+"'".mysql_real_escape_string($string)."'";
}

if(+++++$_POST['username']++==+''+
++++%7C%7C++$_POST['passwd']++++==+''
++++%7C%7C++$_POST['firstname']+==+''+
++++%7C%7C++$_POST['lastname']++==+''
++++%7C%7C++$_POST['email']+++++==+'')
{+
++++exit('You+missed+a+value');
}

$con+=+mysql_connect('localhost',+'root',+'');
if+(!$con){
++die('Could+not+connect:+'+.+mysql_error());
}

mysql_select_db('people',+$con);

//$description+=+mysql_real_escape_string($_POST[description]);
$pword+=+md5($_POST['passwd']);
$sql+=+sprintf('INSERT+INTO+members+(username,+pword,+fname,+lname,+email,+telephone,+ad1,+ad2,+ad3,+pcode)+
++++++++++++++++VALUES(%25s,+%25s,+%25s,+%25s,+%25s,+%25s,+%25s,+%25s,+%25s,+%25s)',+
++++++++++++++++sqlEscape($_POST['username']),
++++++++++++++++sqlEscape($pword),
++++++++++++++++sqlEscape($_POST['firstname']),
++++++++++++++++sqlEscape($_POST['lastname']),
++++++++++++++++sqlEscape($_POST['email']),
++++++++++++++++sqlEscape($_POST['telephone']),
++++++++++++++++sqlEscape($_POST['ad1']),
++++++++++++++++sqlEscape($_POST['street']),
++++++++++++++++sqlEscape($_POST['town']),
++++++++++++++++sqlEscape($_POST['pcode']));

if+(!mysql_query($sql,$con)){
++++die('Error:+'+.+mysql_error());
}

echo+'1+record+added';

mysql_close($con)|1792410|我添加了一个函数(sqlEscape)来运行所有的mysql_real_escape_string，只是为了让转义变得轻而易举。请注意，在建立了MySQL连接之后，我将调用此函数，因为没有连接，mysql_real_escape_string将无法工作。|1792411|entityMap^0|0|7|9|10|A|1F|B|0|0|0|9|9|P|O|2P|O|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|T|8|@$G|U|H|V|I|J]|$G|W|H|X|I|J]|$G|Y|H|Z|I|J]]|9|@]|A|$]]|$1|K|3|L|5|F|7|10|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|11|8|@]|9|@]|A|$B|C]]|$1|O|3|P|5|F|7|12|8|@$G|13|H|14|I|J]|$G|15|H|16|I|J]|$G|17|H|18|I|J]]|9|@]|A|$]]|$1|Q|3|-4|5|F|7|19|8|@]|9|@]|A|$]]]|R|$]]

<pre><code>if( $username == '' || $pword == '' || $fname == '' || $lname == '' || $email == '')
</code></pre>

You are assigning an empty space to the variables by doing <code>$var = ""</code>, instead of comparing with with the comparison operators <code>$var == ''</code>, or stricter <code>$var === ''</code>.

<hr>

This would be a little bit cleaner code to follow and maintain:

<pre><code>function sqlEscape($string){
 return "'".mysql_real_escape_string($string)."'";
}

if( $_POST['username'] == '' 
 || $_POST['passwd'] == ''
 || $_POST['firstname'] == '' 
 || $_POST['lastname'] == ''
 || $_POST['email'] == '')
{ 
 exit('You missed a value');
}

$con = mysql_connect('localhost', 'root', '');
if (!$con){
 die('Could not connect: ' . mysql_error());
}

mysql_select_db('people', $con);

//$description = mysql_real_escape_string($_POST[description]);
$pword = md5($_POST['passwd']);
$sql = sprintf('INSERT INTO members (username, pword, fname, lname, email, telephone, ad1, ad2, ad3, pcode) 
 VALUES(%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)', 
 sqlEscape($_POST['username']),
 sqlEscape($pword),
 sqlEscape($_POST['firstname']),
 sqlEscape($_POST['lastname']),
 sqlEscape($_POST['email']),
 sqlEscape($_POST['telephone']),
 sqlEscape($_POST['ad1']),
 sqlEscape($_POST['street']),
 sqlEscape($_POST['town']),
 sqlEscape($_POST['pcode']));

if (!mysql_query($sql,$con)){
 die('Error: ' . mysql_error());
}

echo '1 record added';

mysql_close($con)
</code></pre>

I added in a function (<code>sqlEscape</code>) to run all the <code>mysql_real_escape_string</code>, just to make the escapes a piece of cake. Notice that I am calling this function after the MySQL connection has been established, because <code>mysql_real_escape_string</code> will NOT work without a connection.

blocks|key|2988933|text|在if's中使用==而不是=。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2988934|if(+$username+==+"+"+%7C%7C+$pword+==+"+"+%7C%7C+$fname+==+"+"+%7C%7C+$lname+==+"+"+%7C%7C+$email+==+"+")|code-block|syntax|javascript|2988935|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Use == instead of = in your if's.

<pre><code>if( $username == " " || $pword == " " || $fname == " " || $lname == " " || $email == " ")
</code></pre>

blocks|key|2988953|text|您应该验证原始POST值，而不是mysql_real_escape_string值。此外，您比较的是(空格)而不是空字符串，并分配它们而不是比较它们。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2988954|entityMap^0|G|O|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

You should validate off the raw POST values, not the <code>mysql_real_escape_string</code> ones. Also you are comparing to <code></code> (space) not empty string and assigning them not comparing them.

blocks|key|3345644|text|去掉这一行中的空格，就需要双等号。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345645|if(+$username+=+"+"+%7C%7C+$pword+=+"+"+%7C%7C+$fname+=+"+"+%7C%7C+$lname+=+"+"+%7C%7C+$email+=+"+")+|code-block|syntax|javascript|3345646|改为|offset|length|style|BOLD|3345647|if(+$username+==+""+%7C%7C+$pword+==+""+%7C%7C+$fname+==+""+%7C%7C+$lname+==+""+%7C%7C+$email+==+"")+|3345648|entityMap^0|0|0|0|2|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@$I|T|J|U|K|L]]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

take out the spaces in this line and you need double equals

<pre><code>if( $username = " " || $pword = " " || $fname = " " || $lname = " " || $email = " ") 
</code></pre>

change to 

<pre><code>if( $username == "" || $pword == "" || $fname == "" || $lname == "" || $email == "") 
</code></pre>

blocks|key|2989046|text|if(+$username+=+"+")不进行比较，而是赋值，而是使用if(+$username+==+"+")+--它仍然检查输入是否为单个空格--char，这可能大部分不是。要检查变量是否有内容，是否使用if(empty($username))。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2989047|另外，对$_POST数组使用array_map来转义值可能更好：|2989048|array_map(function($value)+{
++++return+mysql_real_escape_string($value);
},+$_POST);|code-block|syntax|javascript|2989049|(如果您在PHP5.3之前，需要使用单独的函数声明而不是匿名回调。)|2989050|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/functions.anonymous.php^0|0|K|Z|L|2W|K|0|0|0|S|4|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|14|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|15|8|@]|D|@$9|16|A|17|1|18]]|E|$]]|$1|O|3|-4|5|6|7|19|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]]]

<code>if( $username = " ")</code> does not compare but assign, use <code>if( $username == " ")</code> instead – which still checks, whether the input is a single space-char, which maybe mostly isn't. To check if a variable has content or not use <code>if(empty($username))</code>.

Also its maybe better for you to use array_map on the $_POST-array to escape the values:

<pre><code>array_map(function($value) {
 return mysql_real_escape_string($value);
}, $_POST);
</code></pre>

(If you're prior to PHP 5.3, you need to use a separate function declaration instead of an <a href="http://php.net/manual/en/functions.anonymous.php" rel="nofollow">anonymous callback</a>.)

blocks|key|1792537|text|if(+$username+==+"+"+%7C%7C+$pword+==+"+"+%7C%7C+$fname+==+"+"+%7C%7C+$lname+==+"+"+%7C%7C+$email+==+"+")
{
+echo+'You+missed+a+value';++
+exit();
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1792538|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>if( $username == " " || $pword == " " || $fname == " " || $lname == " " || $email == " ")
{
 echo 'You missed a value'; 
 exit();
}
</code></pre>

blocks|key|1792572|text|检查您的if条件，使用==+=|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1792573|如果错误的话(+$username+=“溶胶-+$pword+=”分部|1792574|entityMap^0|B|2|E|1|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

check your if condition use == instant of =

wrong
 if( $username = " " || $pword = " " || $fname = " " || $lname = " " || $email = " ")

blocks|key|3345749|text|是的，符号"=“是设置变量，比较符号是"==”或"===“。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345750|顺便说一句，要最小化代码，可以使用"array_map“将"mysql_real_escape_string”函数应用于POST数组：|3345751|$post+=+array_map("mysql_real_escape_string",+$_POST);|offset|length|style|CODE|3345752|entityMap^0|0|0|0|1I|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@$F|O|G|P|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

Yeap, the sign "=" is to set a variable, the comparaison sign is "==" or "===" in PHP.

btw, to minimize your code you can use "array_map" to apply "mysql_real_escape_string" function to your POST array :

<code>$post = array_map("mysql_real_escape_string", $_POST);</code>

blocks|key|2989119|text|=是赋值运算符。它给出了一个价值。==是比较算子。它比较了这两件事。===也是一个比较运算符，但它比较值和变量类型是否相同。你得记住这一点。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2989120|此外，您还可以像这样使代码更清晰(这只是一个示例，不要复制粘贴它，因为它可以改进，而且并不完全安全)：|2989121|foreach($_POST+as+$key+=>+$value)
{
++++$columns[]+=+$key;
++++$value+=+mysql_real_escape_string($value);
++++$values[]+=+"'"+.+$value+."'";

++++if(empty($value))
++++{
++++++++$errors[]+=+'POST+with+key+'.+$key+.'+was+not+filled+in';
++++}
}

if(!isset($errors))
{
++++$query+=+"INSERT+INTO+(".+implode(',',+$columns+.")+VALUES+(".+implode(',',+$values+.")";

}
else
{
++++echo+implode('<br+/>',+$errors);
}|code-block|syntax|javascript|2989122|在学习如何编程的同时，如果你发现自己复制了某些代码--那么你就知道它是你可以更聪明地编码的东西。|2989123|entityMap^0|0|1|H|2|Y|3|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|X|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|Y|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|Z|8|@]|D|@]|E|$]]|$1|O|3|-4|5|6|7|10|8|@]|D|@]|E|$]]]|P|$]]

<code>=</code> is assignment operator. It gives a value.
<code>==</code> is comparison operator. It compares the 2 things.
<code>===</code> is also a comparison operator, but it compares whether the values and the variable types are the same. You need to remember that.

Also, you can also make your code clearer like this (it's just an example, don't copy paste it because it can be improved and it's not exactly safe):

<pre><code>foreach($_POST as $key =&gt; $value)
{
 $columns[] = $key;
 $value = mysql_real_escape_string($value);
 $values[] = "'" . $value ."'";

 if(empty($value))
 {
 $errors[] = 'POST with key '. $key .' was not filled in';
 }
}

if(!isset($errors))
{
 $query = "INSERT INTO (". implode(',', $columns .") VALUES (". implode(',', $values .")";

}
else
{
 echo implode('&lt;br /&gt;', $errors);
}
</code></pre>

While learning how to program, if you find yourself copypasting certain code - you then know it's something you can code more intelligently.

I'm trying to validate my form before inserting into database with this code, but I keeps printin 'You missed a value'. I would like your help to figure out the problem.

Thanks

<pre><code>&lt;?php
 $username = mysql_real_escape_string($_POST['username']);
 $pword = mysql_real_escape_string($_POST['passwd']);
 $fname = mysql_real_escape_string($_POST['firstname']);
 $lname = mysql_real_escape_string($_POST['lastname']);
 $email = mysql_real_escape_string($_POST['email']);
 $telephone = mysql_real_escape_string($_POST['telephone']);
 $ad1 = mysql_real_escape_string($_POST['ad1']);
 $ad2 = mysql_real_escape_string($_POST['street']);
 $ad3 = mysql_real_escape_string($_POST['town']);
 $pcode = mysql_real_escape_string($_POST['pcode']);


 if( $username == " " || $pword == " " || $fname == " " || $lname == " " || $email == " ")

 echo 'You missed a value'; 
 exit();

 $con = mysql_connect("localhost","root","");
 if (!$con)
 {
 die('Could not connect: ' . mysql_error());
 }

 mysql_select_db("people", $con);

//$description = mysql_real_escape_string($_POST[description]);
 $pword = md5($pword);
 $sql="INSERT INTO members (username, pword, fname, lname, email, telephone, ad1, ad2, ad3, pcode)
VALUES
('$username','$pword','$fname', '$lname', '$email','$telephone','$ad1','$ad2','$ad3','$pcode')";


 if (!mysql_query($sql,$con)){
 die('Error: ' . mysql_error());
 }
 echo "1 record added";

 mysql_close($con)
?&gt; 
</code></pre>

Validate Input form in PHP

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

在使用此代码插入数据库之前，我正在尝试验证我的表单，但我一直使用printin ‘您遗漏了一个值_’。我希望你能帮我解决这个问题。谢谢<?php $username = mysql_real_escape_string($_POST['username']); $pword = mysql_real_es...

问在PHP中验证输入表单
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在PHP中验证输入表单EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在PHP中验证输入表单
EN