我得到以下代碼：<?php// If user access item through linkif(isset($_POST["v"])) { require "connect.php"; $v = $_POST['v']; $sql = "SELECT * FROM videos WHERE videoID=?;"; $stmt = mysqli_stmt_init($conn); if (!mysqli_stmt_prepare($stmt, $sql)) { echo'Sql Error'; exit(); } else { mysqli_stmt_bind_param($stmt, "i", $v); mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $v)) { ?> <div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div> <center><h1>Title <?php echo $row['Title']; ?> exists</h1></center> <?php exit(); } else { ?> <center><h1>Title does not exist</h1></center> <?php exit(); } }}// If user clicks on itemif(isset($_POST["itemid"])) { require "connect.php"; $itemid = $_POST['itemid']; $sql = "SELECT * FROM videos WHERE videoID=?;"; $stmt = mysqli_stmt_init($conn); if (!mysqli_stmt_prepare($stmt, $sql)) { echo'Sql Error'; exit(); } else { mysqli_stmt_bind_param($stmt, "i", $itemid); mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $itemid)) { ?> <div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div> <center><h1>Title <?php echo $row['Title']; ?> exists</h1></center> <?php exit(); } else { ?> <center><h1>Title does not exist</h1></center> <?php exit(); } }}正如你所看到的兩個(gè) Isset if 非常相似，我想知道是否有一個(gè)解決方案將兩者結(jié)合起來，這樣我就不必兩次編寫相同的結(jié)果，如果有人想提供有關(guān) sql 注入安全性的反饋我的代碼將受到歡迎！這也是我在這里提出的第一個(gè)問題，所以如果您需要我詳細(xì)說明某些內(nèi)容，請(qǐng)告訴我。
2 回答
千巷貓影
TA貢獻(xiàn)1829條經(jīng)驗(yàn) 獲得超7個(gè)贊
您可以通過在語句||中使用運(yùn)算符來實(shí)現(xiàn)if，如下所示，并使用三元運(yùn)算符來獲取用戶是通過鏈接還是通過單擊訪問項(xiàng)目：
<?php
// If user access item through link
if(isset($_POST["v"]) || isset($_POST["itemid"])) {
require "connect.php";
//user ternary operator to check whether user accessed the item through link or click
$var = isset($_POST['v'])?$_POST['v']:$_POST['itemid'];
$sql = "SELECT * FROM videos WHERE videoID=?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo'Sql Error';
exit();
}
else {
mysqli_stmt_bind_param($stmt, "i", $var);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $var)) { ?>
<div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div>
<center><h1>Title <?php echo $row['Title']; ?> exists</h1></center>
<?php exit();
}
else { ?>
<center><h1>Title does not exist</h1></center>
<?php exit();
}
}
}
?>
阿波羅的戰(zhàn)車
TA貢獻(xiàn)1862條經(jīng)驗(yàn) 獲得超6個(gè)贊
是的，除了 POST 參數(shù)之外，兩者似乎都很相似，為什么不使用一個(gè)可以處理兩個(gè) isset 條件的函數(shù)呢！
有點(diǎn)像這樣，
function funcName($param){
require "connect.php";
//$v = $_POST['v'];
$sql = "SELECT * FROM videos WHERE videoID=?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo'Sql Error';
exit();
}
else {
mysqli_stmt_bind_param($stmt, "i", $param);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (($row = mysqli_fetch_assoc($result)) && !preg_match("/[a-zA-Z]/", $v)) { ?>
<div class="img" style="background-image: url('<?php echo $row['link']; ?>');"></div>
<center><h1>Title <?php echo $row['Title']; ?> exists</h1></center>
<?php exit();
}
else { ?>
<center><h1>Title does not exist</h1></center>
<?php exit();
}
}
}
然后，
if(isset($_POST["v"])) {
$param = $_POST["v"];
funcName($param);
}
if(isset($_POST["itemid"])) {
$param = $_POST["itemid"];
funcName($param);
}
- 2 回答
- 0 關(guān)注
- 149 瀏覽
添加回答
舉報(bào)
0/150
提交
取消