PHP学习记录02

PHP 表单验证

参考：https://www.runoob.com/php/php-form-validation.html

第一步开启环境：phpstudy、Sublime TEXT、浏览器、操作系统

 <!DOCTYPE HTML> 
 <html>
 <head>
 <meta charset="utf-8">
 <title></title>
 <style>
 .error {color: #FF0000;}
 </style>
 </head>
 <body> 
 
 <?php
 // 定义变量并默认设置为空值
 $nameErr = $emailErr = $genderErr = $websiteErr = "";
 $name = $email = $gender = $comment = $website = "";
 
 if ($_SERVER["REQUEST_METHOD"] == "POST")
 {
     if (empty($_POST["name"]))
     {
         $nameErr = "名字是必需的";
     }
     else
     {
         $name = test_input($_POST["name"]);
         // 检测名字是否只包含字母跟空格
         if (!preg_match("/^[a-zA-Z ]*$/",$name))
         {
             $nameErr = "只允许字母和空格"; 
         }
     }
     
     if (empty($_POST["email"]))
     {
       $emailErr = "邮箱是必需的";
     }
     else
     {
         $email = test_input($_POST["email"]);
         // 检测邮箱是否合法
         if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email))
         {
             $emailErr = "非法邮箱格式"; 
         }
     }
     
     if (empty($_POST["website"]))
     {
         $website = "";
     }
     else
     {
         $website = test_input($_POST["website"]);
         // 检测 URL 地址是否合法
         if (!preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i",$website))
         {
             $websiteErr = "非法的 URL 的地址"; 
         }
     }
     
     if (empty($_POST["comment"]))
     {
         $comment = "";
     }
     else
     {
         $comment = test_input($_POST["comment"]);
     }
     
     if (empty($_POST["gender"]))
     {
         $genderErr = "性别是必需的";
     }
     else
     {
         $gender = test_input($_POST["gender"]);
     }
 }
 
 function test_input($data)
 {
     $data = trim($data);
     $data = stripslashes($data);
     $data = htmlspecialchars($data);
     return $data;
 }
 ?>
 
 <h2>PHP 表单验证实例</h2>
 <p><span class="error">* 必需字段。</span></p>
 <form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"> 
    名字: <input type="text" name="name" value="<?php echo $name;?>">
    <span class="error">* <?php echo $nameErr;?></span>
    <br><br>
    E-mail: <input type="text" name="email" value="<?php echo $email;?>">
    <span class="error">* <?php echo $emailErr;?></span>
    <br><br>
    网址: <input type="text" name="website" value="<?php echo $website;?>">
    <span class="error"><?php echo $websiteErr;?></span>
    <br><br>
    备注: <textarea name="comment" rows="5" cols="40"><?php echo $comment;?></textarea>
    <br><br>
    性别:
    <input type="radio" name="gender" <?php if (isset($gender) && $gender=="female") echo "checked";?>  value="female">女
    <input type="radio" name="gender" <?php if (isset($gender) && $gender=="male") echo "checked";?>  value="male">男
    <span class="error">* <?php echo $genderErr;?></span>
    <br><br> 
   <input type="submit" name="submit" value="Submit">  
</form> 
 
<?php 
echo "<h2>您输入的内容是:</h2>"; 
echo $name; 
echo "<br>"; 
echo $email; 
echo "<br>"; 
echo $website; 
echo "<br>"; 
echo $comment; 
echo "<br>"; 
echo $gender; 
?> 
 
</body> 
</html>

html界面

 <!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
     <title></title>
 </head>
 <body>
 
 <h2>PHP表单验证实例</h2>
 <p>*必需字段</p>
 <form>
 名字:<input type="text" name="name">*<br>
 E-mail:<input type="text" name="email">*<br>
 网址:<input type="text" name="website"><br>
 备注:<textarea name="comment" rows="5" cols="40"></textarea><br>
 性别:<input type="radio" name="gender" value="female">女
 <input type="radio" name="gender" value="man">男*<br>
 <input type="submit" name="submit" value="Submit">
 <h2>您输入的内容是:</h2>
 </form>
 </body>
 </html>

php代码

<script>alert(document.cookie)</script>
 /%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E
 <script>alert('hacked')</script>

漏洞分析

在输入框中输入

php1.php

 <!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
     <title></title>
 </head>
 <body>
     <form action="php3.php" method="post">
 user:<input type="text" name="1">
 pass:<input type="text" name="2">
 <br>
 <input type="submit" name="3">
     </form>
 
 </body>
 </html>

php2.php

 <!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
     <title></title>
 </head>
 <body>
     <h1>这是GET获取的位置</h1>
 用户名：<?php  
 echo $_GET['1']; 
 ?>
 <br>
 密码：<?php  
 echo $_GET['2'];
 ?>
 </body>
 </html>

php3.php

在url中输入

 /%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E

 <!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
     <title></title>
 </head>
 <body>
         <h1>这是POST获取的位置</h1>
 用户名：<?php  
 echo $_POST['1']; 
 ?>
 <br>
 密码：<?php  
 echo $_POST['2'];
 ?>
 <form action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
 user:<input type="text" name="1">
 pass:<input type="text" name="2">
 <br>
 <input type="submit" name="3">
     </form>
 
 </body>
 </html>

php5.php

 <!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
     <title></title>
 </head>
 <body>
 
 <h1>这是POST获取的位置</h1>
 用户名：<?php  
 echo $_POST['1']; 
 ?>
 <br>
 密码：<?php  
 echo $_POST['2'];
 ?>
 <form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" method="post">
 user:<input type="text" name="1">
 pass:<input type="text" name="2">
 <br>
 <input type="submit" name="3">
     </form>
 
 </body>
 </html>

PHP 验证表单数据

当用户提交表单时，我们将做以下两件事情：

使用 PHP trim() 函数去除用户输入数据中不必要的字符 (如：空格，tab，换行)。
使用PHP stripslashes()函数去除用户输入数据中的反斜杠 ()

接下来让我们将这些过滤的函数写在一个我们自己定义的函数中，这样可以大大提高代码的复用性。

将函数命名为 test_input()。

现在，我们可以通过test_input()函数来检测 $_POST 中的所有变量, 脚本代码如下所示：

注意我们在执行以上脚本时，会通过$_SERVER["REQUEST_METHOD"]来检测表单是否被提交 。如果 REQUEST_METHOD 是 POST, 表单将被提交 - 数据将被验证。如果表单未提交将跳过验证并显示空白。

<?php
// 定义变量并默认设置为空值
$name = $email = $gender = $comment = $website = "";
 
if ($_SERVER["REQUEST_METHOD"] == "POST")
{
  $name = test_input($_POST["name"]);
  $email = test_input($_POST["email"]);
  $website = test_input($_POST["website"]);
  $comment = test_input($_POST["comment"]);
  $gender = test_input($_POST["gender"]);
}
 
function test_input($data)
{
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}
?>

 <!DOCTYPE HTML> 
<html>
<head>
<meta charset="utf-8">
<title></title>
</head>
<body> 

<?php
// 定义变量并默认设置为空值
$name = $email = $gender = $comment = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST")
{
   $name = test_input($_POST["name"]);
   $email = test_input($_POST["email"]);
   $website = test_input($_POST["website"]);
   $comment = test_input($_POST["comment"]);
   $gender = test_input($_POST["gender"]);
}

function test_input($data)
{
   $data = trim($data);
   $data = stripslashes($data);
   $data = htmlspecialchars($data);
   return $data;
}
?>

<h2>PHP 表单验证实例</h2>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"> 
   名字: <input type="text" name="name">
   <br><br>
   E-mail: <input type="text" name="email">
   <br><br>
   网址: <input type="text" name="website">
   <br><br>
   备注: <textarea name="comment" rows="5" cols="40"></textarea>
   <br><br>
   性别:
   <input type="radio" name="gender" value="female">女
   <input type="radio" name="gender" value="male">男
   <br><br>
   <input type="submit" name="submit" value="Submit"> 
</form>

<?php
echo "<h2>您输入的内容是:</h2>";
echo $name;
echo "<br>";
echo $email;
echo "<br>";
echo $website;
echo "<br>";
echo $comment;
echo "<br>";
echo $gender;
?>

</body>

表单 - 必需字段

字段	验证规则
名字	必需。 + 只能包含字母和空格
E-mail	必需。 + 必需包含一个有效的电子邮件地址（包含"@"和"."）
网址	可选。如果存在，它必需包含一个有效的URL
备注	可选。多行字段（文本域）。
性别	必需。必需选择一个。

在以下代码中我们加入了一些新的变量: $nameErr, $emailErr, $genderErr, 和 $websiteErr.。这些错误变量将显示在必需字段上。 我们还为每个$_POST变量增加了一个if else语句。 这些语句将检查 $_POST 变量是 否为空（使用php的 empty() 函数）。如果为空，将显示对应的错误信息。 如果不为空，数据将传递给test_input() 函数：

必需字段

<?php
// 定义变量并默认设为空值
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
  if (empty($_POST["name"])) {
    $nameErr = "名字是必需的。";
  } else {
    $name = test_input($_POST["name"]);
  }

  if (empty($_POST["email"])) {
    $emailErr = "邮箱是必需的。";
  } else {
    $email = test_input($_POST["email"]);
  }

  if (empty($_POST["website"])) {
    $website = "";
  } else {
    $website = test_input($_POST["website"]);
  }

  if (empty($_POST["comment"])) {
    $comment = "";
  } else {
    $comment = test_input($_POST["comment"]);
  }

  if (empty($_POST["gender"])) {
    $genderErr = "性别是必需的。";
  } else {
    $gender = test_input($_POST["gender"]);
  }
}
?>

显示错误信息

<form method="post" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']);?>"> 
   名字: <input type="text" name="name">
   <span class="error">* <?php echo $nameErr;?></span>
   <br><br>
   E-mail: <input type="text" name="email">
   <span class="error">* <?php echo $emailErr;?></span>
   <br><br>
   网址: <input type="text" name="website">
   <span class="error"><?php echo $websiteErr;?></span>
   <br><br>
   备注: <textarea name="comment" rows="5" cols="40"></textarea>
   <br><br>
   性别:
   <input type="radio" name="gender" value="female">女
   <input type="radio" name="gender" value="male">男
   <span class="error">* <?php echo $genderErr;?></span>
   <br><br>
   <input type="submit" name="submit" value="Submit"> 
</form>

<!DOCTYPE HTML> 
<html>
<head>
<meta charset="utf-8">
<title></title>
<style>
.error {color: #FF0000;}
</style>
</head>
<body>

<?php
// 定义变量并默认设为空值
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
   if (empty($_POST["name"])) {
      $nameErr = "名字是必须的。";
   } else {
      $name = test_input($_POST["name"]);
   }

   if (empty($_POST["email"])) {
      $emailErr = "邮箱是必须的。";
   } else {
      $email = test_input($_POST["email"]);
   }

   if (empty($_POST["website"])) {
      $website = "";
   } else {
      $website = test_input($_POST["website"]);
   }

   if (empty($_POST["comment"])) {
      $comment = "";
   } else {
      $comment = test_input($_POST["comment"]);
   }

   if (empty($_POST["gender"])) {
      $genderErr = "性别是必须的。";
   } else {
      $gender = test_input($_POST["gender"]);
   }
}

function test_input($data) {
   $data = trim($data);
   $data = stripslashes($data);
   $data = htmlspecialchars($data);
   return $data;
}
?>

<h2>PHP 表单验证实例</h2>
<p><span class="error">* 必填字段。</span></p>
<form method="post" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']);?>"> 
   名字: <input type="text" name="name">
   <span class="error">* <?php echo $nameErr;?></span>
   <br><br>
   E-mail: <input type="text" name="email">
   <span class="error">* <?php echo $emailErr;?></span>
   <br><br>
   网址: <input type="text" name="website">
   <span class="error"><?php echo $websiteErr;?></span>
   <br><br>
   备注: <textarea name="comment" rows="5" cols="40"></textarea>
   <br><br>
   性别:
   <input type="radio" name="gender" value="female">女
   <input type="radio" name="gender" value="male">男
   <span class="error">* <?php echo $genderErr;?></span>
   <br><br>
   <input type="submit" name="submit" value="Submit"> 
</form>

<?php
echo "<h2>您的输入:</h2>";
echo $name;
echo "<br>";
echo $email;
echo "<br>";
echo $website;
echo "<br>";
echo $comment;
echo "<br>";
echo $gender;
?>

</body>
</html>

验证邮件和URL

preg_match() 函数；https://www.runoob.com/php/php-preg_match.html

preg_match — 进行正则表达式匹配。

语法：
int preg_match ( string $pattern , string $subject [, array $matches [, int $flags ]] )


在 subject 字符串中搜索与 pattern 给出的正则表达式相匹配的内容。如果提供了 matches ，则其会被搜索的结果所填充。$matches[0] 将包含与整个模式匹配的文本，$matches[1] 将包含与第一个捕获的括号中的子模式所匹配的文本，以此类推。

验证名称

$name = test_input($_POST["name"]);
if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
  $nameErr = "只允许字母和空格"; 
}

验证邮件

$email = test_input($_POST["email"]);
if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email)) {
  $emailErr = "非法邮箱格式"; 
}

验证 URL

$website = test_input($_POST["website"]);
if (!preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i",$website)) {
  $websiteErr = "非法的 URL 的地址"; 
}

验证 Name, E-mail, 和 URL

 <?php
 // 定义变量并默认设置为空值
 $nameErr = $emailErr = $genderErr = $websiteErr = "";
 $name = $email = $gender = $comment = $website = "";
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (empty($_POST["name"])) {
       $nameErr = "Name is required";
       } else {
          $name = test_input($_POST["name"]);
          // 检测名字是否只包含字母跟空格
          if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
          $nameErr = "只允许字母和空格"; 
          }
      }
    
    if (empty($_POST["email"])) {
       $emailErr = "Email is required";
    } else {
       $email = test_input($_POST["email"]);
       // 检测邮箱是否合法
       if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email)) {
          $emailErr = "非法邮箱格式"; 
       }
    }
      
    if (empty($_POST["website"])) {
       $website = "";
    } else {
       $website = test_input($_POST["website"]);
       // 检测 URL 地址是否合法
      if (!preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i",$website)) {
          $websiteErr = "非法的 URL 的地址"; 
       }
    }
 
    if (empty($_POST["comment"])) {
       $comment = "";
    } else {
       $comment = test_input($_POST["comment"]);
    }
 
    if (empty($_POST["gender"])) {
       $genderErr = "性别是必需的";
    } else {
       $gender = test_input($_POST["gender"]);
    }
 }
 ?>

 <!DOCTYPE HTML> 
 <html>
 <head>
 <meta charset="utf-8">
 <title>菜鸟教程(runoob.com)</title>
 <style>
 .error {color: #FF0000;}
 </style>
 </head>
 <body> 
 
 <?php
 // 定义变量并默认设置为空值
 $nameErr = $emailErr = $genderErr = $websiteErr = "";
 $name = $email = $gender = $comment = $website = "";
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (empty($_POST["name"])) {
       $nameErr = "Name is required";
       } else {
          $name = test_input($_POST["name"]);
          // 检测名字是否只包含字母跟空格
          if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
          $nameErr = "只允许字母和空格"; 
          }
      }
    
    if (empty($_POST["email"])) {
       $emailErr = "Email is required";
    } else {
       $email = test_input($_POST["email"]);
       // 检测邮箱是否合法
       if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email)) {
          $emailErr = "非法邮箱格式"; 
       }
    }
      
    if (empty($_POST["website"])) {
       $website = "";
    } else {
       $website = test_input($_POST["website"]);
       // 检测 URL 地址是否合法
      if (!preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i",$website)) {
          $websiteErr = "非法的 URL 的地址"; 
       }
    }
 
    if (empty($_POST["comment"])) {
       $comment = "";
    } else {
       $comment = test_input($_POST["comment"]);
    }
 
    if (empty($_POST["gender"])) {
       $genderErr = "性别是必需的";
    } else {
       $gender = test_input($_POST["gender"]);
    }
 }
 
 function test_input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
 }
 ?>
 
 <h2>PHP 表单验证实例</h2>
 <p><span class="error">* 必需字段。</span></p>
 <form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"> 
    名字: <input type="text" name="name">
    <span class="error">* <?php echo $nameErr;?></span>
    <br><br>
    E-mail: <input type="text" name="email">
    <span class="error">* <?php echo $emailErr;?></span>
    <br><br>
    网址: <input type="text" name="website">
    <span class="error"><?php echo $websiteErr;?></span>
    <br><br>
    备注: <textarea name="comment" rows="5" cols="40"></textarea>
    <br><br>
    性别:
    <input type="radio" name="gender" value="female">女
    <input type="radio" name="gender" value="male">男
    <span class="error">* <?php echo $genderErr;?></span>
    <br><br>
    <input type="submit" name="submit" value="Submit"> 
 </form>
 
 <?php
 echo "<h2>您输入的内容是:</h2>";
 echo $name;
 echo "<br>";
 echo $email;
 echo "<br>";
 echo $website;
 echo "<br>";
 echo $comment;
 echo "<br>";
 echo $gender;
 ?>
  
</body> 
</html>

posted @ 2021-06-08 09:59 菜鸟-传奇阅读(89) 评论(0) 编辑收藏举报

刷新页面返回顶部

菜鸟-传奇

愿路途漫长，以后莫失莫忘。愿你不骄不躁，安稳顺心。

PHP学习记录02

PHP学习记录02

PHP 表单验证

html界面

php代码

漏洞分析

php3.php

PHP 验证表单数据

表单 - 必需字段

必需字段

显示错误信息

验证邮件和URL

验证名称

验证邮件

验证 URL

验证 Name, E-mail, 和 URL

愿路途漫长，以后莫失莫忘。愿你不骄不躁，安稳顺心。

公告

菜鸟-传奇

愿路途漫长，以后莫失莫忘。 愿你不骄不躁，安稳顺心。

PHP学习记录02

PHP学习记录02

PHP 表单验证

html界面

php代码

漏洞分析

php3.php

PHP 验证表单数据

表单 - 必需字段

必需字段

显示错误信息

验证邮件和URL

验证名称

验证邮件

验证 URL

验证 Name, E-mail, 和 URL

公告

愿路途漫长，以后莫失莫忘。愿你不骄不躁，安稳顺心。