|
 |
| |
ขอความช่วยเหลือหน่อยครับ เรื่อง SQL injection หาวิธีป้อง กัน ซึ่งลอง mysql_real_escape_string() แล้วไม่ได้ผล PHP+Mysql |
| |
 |
|
|
 |
 |
|
คือ ต้องการป้องกัน SQL injection แต่ลองใช้ mysql_real_escape_string() แล้ว แต่ไม่เกิดผล ไม่รู้ว่าควรแก้ยังไง ขอให้ผู้รู้ช่วยกันตอบหน่อยครับ
Code (PHP)
<? ob_start();
@session_start();
$id = mysql_real_escape_string($_GET["id"]);
$page = mysql_real_escape_string($_GET["page"]);
$connection_id = mysql_connect("localhost","root","1234") or die("Can not connect to Database");
mysql_select_db("db");
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>xxxxx.com</title>
<link rel="stylesheet" href="css/style.css" type="text/css" />
<link rel="stylesheet" type="text/css" href="css/smoothness/jquery-ui-1.7.2.custom.css">
<style type="text/css">
.ui-datepicker{
width:200px;
font-family:tahoma;
font-size:11px;
text-align:center;
margin-top:15px;
}
<!--
body {
margin-left: 0px;
margin-top: 0px;
margin-right: 0px;
margin-bottom: 0px;
}
-->
</style>
<script type="text/javascript" src="scripts/jquery-1.3.2.min.js"></script>
<script type="text/javascript" src="scripts/jquery-ui-1.7.2.custom.min.js"></script>
<script type="text/javascript" src="fckeditor/fckeditor.js"></script>
<script type="text/javascript" src="scripts/jquery.start.js"></script>
<script type="text/javascript">
$(document).ready(function() {
$("#dateInput").datepicker();
var contentHeight = $('#content').height();
var sidebarHeight = $('#navigation').height();
if (contentHeight > sidebarHeight) {
$('#sidebar').css('height', contentHeight);
} else {
$('#content').css('height', sidebarHeight);
}
});
function popup_alert(url)
{
newwindow=window.open(url,'name','height=300,width=400,left=10,top=200');
if (window.focus) {newwindow.focus()}
};
/*function addemo(x){
document.frmComment.detail.value = document.frmComment.detail.value +" "+ x;
document.frmComment.detail.focus();
return false();
};*/
function getFckValue(strFCKName){
oEditor = FCKeditorAPI.GetInstance(strFCKName) ;
return oEditor.GetHTML();
}
function chknull(){
oEditor = FCKeditorAPI.GetInstance('detail') ;
if(oEditor.GetHTML()==""){
alert("Please insert detail !");
return false;
}
if(document.frmComment.strCheck.value==""||document.frmComment.strCheck.value==null){
alert('กรุณากรอกรหัสตรวจสอบตัวตน !');
document.frmComment.strCheck.focus();
return false;
}
return true;
}
</script>
</head>
<body>
<table width="955" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td colspan="2"><table width="955" border="0" cellspacing="0" cellpadding="0">
<div id="banner">
<tr>
<td><img src="./images/bannerkm_new.jpg" width="955" height="200" border="0" /></td>
</tr>
</div>
<div id="menu">
<tr>
<td align="right" bgcolor="#990099"><? include "menu.php"; ?></td>
</tr>
</div>
</table></td>
</tr>
<tr valign="top">
<div id="left_menu">
<td width="230px" valign="top" background="./images/test4 copy.jpg">
<? include "left_menu.php"; ?>
</td>
</div>
<div id="content">
<?php
#######################################################################
# $page = (isset($_GET['page']))? intval($_GET["page"]) : 0;
# $limit_end = 20;
# $limit_start = ($page-1)*$limit_end;
# $sql = "select * from table limit " . $limit_start. "," . $limit_end;
# page_navi($page, $limit_end, 4, 1000, "_self", "current_page", "other_page", $querystring);
#######################################################################
# $page = หน้าปัจจุบัน
# $limit= จำนวน record ต่อหน้า
# $range= บวกลบจากหน้าปัจจุบัน ใส่ 4 จะได้ตัวเลขออกมา 9
# $count= จำนวน record ทั้งหมด
# $send= ส่งตัวแปรอะไรไปด้วย
# $current_style = css สำหรับหน้าปัจจุบัน
# $other_style = css สำหรับอื่นๆ รวมถึง Prev Next First Last
# $target= อันนี้รู้ๆ กัน
#######################################################################
function page_navi($page, $limit, $range, $count, $send=NULL, $current_style="navi_on", $other_style="navi_out", $target="_self"){
$output = "";
$total = ceil($count/$limit);
$navi_start = $page-$range;
$navi_end = $page+$range;
$send .= (!empty($send))? "&" : NULL;
if($navi_start <= 0) $navi_start = 1;
if($navi_end >= $total) $navi_end = $total;
if($page>1){
$navi_back = $page-1;
if($page > 2)
$output .= "<a href=\"?" . $send . "page=1\" target=\"" . $target . "\" class=\"" . $other_style . "\"><strong>«</strong></a> ";
$output .= "<a href=\"?" . $send . "page=" . $navi_back . "\" target=\"" . $target . "\" class=\"" . $other_style . "\"><strong>‹</strong></a> ";
}
for($i = $navi_start; $i <= $navi_end; $i++){
if($i == $page)
$output .= "<a href=\"?" . $send . "page=" . $i . "\" target=\"" . $target . "\" class=\"" . $current_style . "\"><strong><font color=\"" . $other_style . "\">$i</font></strong></a> ";
else
$output .= "<a href=\"?" . $send . "page=" . $i . "\" target=\"" . $target . "\" class=\"" . $other_style . "\">$i</a> ";
}
if($page < $total){
$navi_next = $page+1;
$output .= "<a href=\"?" . $send . "page=" . $navi_next . "\" target=\"" . $target . "\" class=\"" . $other_style . "\"><strong>›</strong></a> ";
if(($page+1) < $total)
$output .= "<a href=\"?" . $send . "page=" . $total . "\" target=\"" . $target . "\" class=\"" . $other_style . "\"><strong>»</strong></a>";
}
if($navi_start>$navi_end)
$output .= "<a href=\"?" . $send . "page=" . $page . "\" target=\"" . $target . "\" class=\"" . $other_style . "\"><strong>$page</strong></a> ";
return $output;
}
?>
<td align="center" valign="top" width="725px" background="./images/test7 copy.jpg">
<!-- top navigator -->
<table width="95%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left" class="top_navi">
<div class="left">
<a href="index.php"><b>หน้าแรก</b></a>
>
<a href="entry.php"><b>บทความ</b></a> >
<b>รายละเอียด</b>
</div>
<?
if($_SESSION['level']<>""||$_SESSION['level']<>null){
?>
<div class="right">
<b>ผู้ใช้</b>
<font color="#FF00FF"><?=$_SESSION['username']?></font>
<a href="log_out.php">
<b>ออกจากระบบ</b>
</a>
</div>
<?
}
?>
</td>
</tr>
</table>
<!-- end top navigator -->
<br />
<br />
<?
include "./connect/connect.php";
include "function.php";
$sql1 = sprintf("SELECT enid,entopic,enuser,endate,endetail,enfile_name,en_ref_file_name,enip,enemail
FROM kmentry
WHERE enid = '$id'",mysql_real_escape_string($id));
$result1 = mysql_db_query($dbname,$sql1) or die('SQL ERROR');
while($row1 = mysql_fetch_array($result1)){
$enid = $row1['enid'];
$entopic = $row1['entopic'];
$enauthor = $row1['enuser'];
$endetail = $row1['endetail'];
$enip = $row1['enip'];
$endate = displaydate($row1['endate']);
$entime = displaytime($row1['endate']);
$enemail = $row1['enemail'];
$enfile_name = $row1['enfile_name'];
$en_ref_file_name = $row1['en_ref_file_name'];
}
///////////////////////////// count visit entry ////////////////////////////
$sql5 = sprintf("update kmentry set encount = encount+1 where enid = '$enid'",mysql_real_escape_string($enid));
$result5 = mysql_db_query($dbname,$sql5) or die ('SQL ERROR');
//////////////////////////// close count visit entry /////////////////////////
?>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="h1_entry_preview"><?=$entopic?></td>
</tr>
<tr>
<td class="h2_entry_preview12px">
เขียนโดย:
<font color="#FF9900"><?=$enauthor?></font> ,
<?=$endate?> ,
<font color="#FF0000"><b>IP: <?=$enip?></b></font> </td>
</tr>
<tr>
<td><p class="hr1_entry_preview"> </p></td>
</tr>
<tr>
<td class="detail_entry_preview"><?=$endetail?></td>
</tr>
<tr>
<td>
<br />
<?
if($enfile_name==""||$enfile_name==null){ //not have attach file
//echo "ไม่มีไฟล์แนบ";
}
else{ //have attach file
/////////////// show file ////////////////
$file_type = explode(".",$en_ref_file_name);
$ext = strtolower($file_type[count($file_type)-1]);
//echo $ext;
if($ext=="wmv"||$ext=="avi"||$ext=="gif"||$ext=="jpg"||$ext=="jpeg"||$ext=="dat"){ // correct type file to can show
switch ($ext){
//type="application/x-mplayer2"
case "dat":
?>
<center>
<embed src="./attach_entry/<?=$en_ref_file_name?>" type="application/x-mplayer2" autostart="true" width="350" height="289" />
</center>
<?
break;
case "wmv":
?>
<center>
<object data="./attach_entry/<?=$en_ref_file_name?>" width="350" height="289">
<param name="src" value="./attach_entry/<?=$en_ref_file_name?>" />
<param name="autoplay" value="true" />
<param name="autostart" value="1" />
</object>
</center>
<?
break;
case "avi":
?>
<center>
<object data="./attach_entry/<?=$en_ref_file_name?>" width="350" height="289">
<param name="src" value="./attach_entry/<?=$en_ref_file_name?>" />
<param name="autoplay" value="true" />
<param name="autostart" value="1" />
</object>
</center>
<?
break;
case "gif":
?>
<center>
<img src="./attach_entry/<?=$en_ref_file_name?>" />
</center>
<?
break;
case "jpg":
?>
<center>
<img src="./attach_entry/<?=$en_ref_file_name?>" />
</center>
<?
break;
case "jpeg":
?>
<center>
<img src="./attach_entry/<?=$en_ref_file_name?>" />
</center>
<?
break;
}
}
else{ // wrong type file to can not show
//echo "anothor file is not Video file";
}
/////////////// close show file //////////
}
?>
<br />
<br />
</td>
</tr>
<?
if($enfile_name==""||$enfile_name==null){ // not have attach file
echo "";
}
else{ // have attach file
?>
<tr class="./attach_link">
<td class="h2_entry_preview12px">
<b>ไฟล์แนบ : </b>
<a href="./attach_entry/<?=$en_ref_file_name?>">
<?=$enfile_name?>
</a>
<br />
<br />
</td>
</tr>
<?
}
?>
<tr>
<td class="email_entry_preview">
<div class="right">
<font color="#000000">
<b>อีเมล:</b> </font> <?=$enemail?></div> </td>
</tr>
<tr>
<td height="30"><hr width="98%" /></td>
</tr>
<?
$page = (isset($page))? intval($page) : 1;
$limit_end = 10;
$limit_start = ($page-1)*$limit_end;
$send = "";
if(isset($id) and $id != ""){
$send = "id=" . $id;
$condition= sprintf(" WHERE enid =".$id." ORDER BY comdate DESC ",mysql_real_escape_string($id));
}
$sql = "SELECT comid,comuser,comdate,comdetail,comip,comemail
FROM kmcomm" . $condition;
$query_id = mysql_query($sql . " LIMIT " . $limit_start. "," . $limit_end, $connection_id);
$count = mysql_num_rows($query_id);
//////////////////////////////////////////////////////////////
$result5 = mysql_db_query($dbname,$sql) or die('SQL ERROR');
$num_com = mysql_num_rows($result5);
///////////////////////////////////////////////////////////////
$total = mysql_num_rows(mysql_query($sql, $connection_id));
/*
if($total > 0){
$n=1;
*/
/*$sql2 = "SELECT comid,comuser,comdate,comdetail,comip,comemail
FROM kmcomm
WHERE enid = '$id'
ORDER BY comdate DESC";
$result2 = mysql_db_query($dbname,$sql2);
$num_com = mysql_num_rows($result2);*/
?>
<tr>
<td> </td>
</tr>
<tr>
<?
if($total > 0){
$n=1;
?>
<td align="left" class="h3_comment_violet"><img src="./images/comment.png" /> ความคิดเห็น (<?=$num_com?>)</td>
</tr>
<tr>
<td> </td>
</tr>
<?
while($rows = mysql_fetch_assoc($query_id)){
$comid = $rows['comid'];
$author = $rows['comuser'];
$date = displaydate($rows['comdate']);
$detail = $rows['comdetail'];
$email = $rows['comemail'];
$com_ip = $rows['comip'];
if($num_com>0){ // have comment
//echo "มีความคิดเห็น"; */
?>
<?
/*
$i=1;
while($row2 = mysql_fetch_array($result2)){
$comid = $row2['comid'];
$author = $row2['comuser'];
$date = displaydate($row2['comdate']);
$detail = $row2['comdetail'];
$email = $row2['comemail'];
$com_ip = $row2['comip'];
if($num_com>0){ // have comment
//echo "มีความคิดเห็น"; */
?>
<tr>
<td>
<div class="link_comment">
<table width="686" class="border_all1">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="515px"><table width="515px" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="501px"><font size="2px"> ... </font> </td>
</tr>
</table></td>
</tr>
<tr>
<td align="left"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="501px"><font size="2px"> <b>แสดงความคิดเห็นโดย</b>
<?=$author ?>
,
<?=$date ?>
</font> </td>
</tr>
</table></td>
</tr>
<tr>
<td align="left"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="511px"><font size="2px"> <b>Email:</b>
<?=$email ?>
</font> </td>
</tr>
<tr>
<td width="15px"> </td>
<td width="501px"> </td>
</tr>
</table></td>
</tr>
</table></td>
<td width="162px">
<table width="162px" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="5px"></td>
</tr>
<tr>
<td align="center">
<?
$sql4 = sprintf("select id_name,picture,ref_picture_name from km_member where id_name = '$author'",mysql_real_escape_string($author));
$result4 = mysql_db_query($dbname,$sql4) or die('SQL ERROR');
while($row4 = mysql_fetch_array($result4)){
$picture = $row4[picture];
$ref_picture_name = $row4[ref_picture_name];
}
if($picture==null||$picture==""){
?>
<img src="./images/default.jpg" width="80px" height="80px" />
<?
//echo "not have";
}
else{
//echo "have";
?>
<img src="./member_picture/<?=$ref_picture_name?>" />
<?
}
?> </td>
</tr>
<tr>
<td height="5px"></td>
</tr>
</table> </td>
</tr>
</table>
</td>
</tr>
<tr>
<td align="left" style="padding-left:10px;">
<?=$detail?>
</td>
</tr>
<tr>
<td align="right">
<font color="#FF0000" size="2px"><b>IP: </b><?=$com_ip ?></font>
</font> <font size="2px">
[
<a href="javascript:popup_alert('alert_notify_foul_comment.php?comid=<?=$comid?>&number_comment=<?=$i?>');">
แจ้งลบ</a>
]
<?
if($_SESSION['level']=='0'){
?>
[
<a href="delete_comment.php?id_del=<?=$comid?>" onclick="return confirm('ยืนยันต้องการลบ?');">
ลบ</a>
]
<?
}
?>
<br /><br />
</font> </td>
</tr>
</table> </td>
</tr>
</table>
</div> </td>
</tr>
<tr>
<td height="5px"></td>
</tr>
<?
}
else{ // not have comment
echo "ไม่มีความคิดเห็น";
}
$n++;
} //close while rows
?>
<tr>
<td>
<div class="link_comment">
<!--
<table width="686" class="border_all1">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="518">
<table width="518" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
... </font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<b>แสดงความคิดเห็นโดย</b>
<?=$author ?> ,
<?=$date ?>
</font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<?=str_replace($replaced,$replace,$detail); ?>
</font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<b>Email:</b> <?=$email ?>
</font> </td>
</tr>
</table> </td>
</tr>
</table> </td>
<td width="168">
<table width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="5px"></td>
</tr>
<tr>
<td align="center">
<img src="images/default.jpg" width="80px" height="80px" /> </td>
</tr>
<tr>
<td height="5px"></td>
</tr>
</table> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="right">
<font color="#FF0000" size="2px"><b>IP: </b><?=$com_ip ?></font>
</font> <font size="2px">
[
<a href="#">
แจ้งลบ </a>
]
<? if($_SESSION['level']=="0"){
?>
[
<a href="#">
ลบ </a>
]
<?
}
?>
<br /><br />
</font> </td>
</tr>
</table> </td>
</tr>
</table>-->
</div> </td>
</tr>
<tr>
<td>
<? echo "\n<div class = 'left'><span class='data_entry'>หน้า : " . page_navi($page, $limit_end, 4, $total, $send) ?>
<? echo "</span></div><div class = 'right'><span class='data_entry'>[".($limit_start+1) . "-" . ($limit_start+$count) . "] จากทั้งหมด <strong>" . $total . " </strong></span></div>";
}//close if($num>0)
?>
</td>
</tr>
<tr>
<td> </td>
</tr>
<tr>
<td>
<div class="link_comment">
<!--
<table width="686" class="border_all2">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<table width="686" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="518">
<table width="518" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
... </font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<b>แสดงความคิดเห็นโดย</b>
<?=$author ?> ,
<?=$date ?>
</font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<?=str_replace($replaced,$replace,$detail); ?>
</font> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="left">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="15px"> </td>
<td width="503px">
<font size="2px">
<b>Email:</b> <?=$email ?>
</font> </td>
</tr>
</table> </td>
</tr>
</table> </td>
<td width="168">
<table width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="5px"></td>
</tr>
<tr>
<td align="center">
<img src="images/default.jpg" width="80px" height="80px" /> </td>
</tr>
<tr>
<td height="5px"></td>
</tr>
</table> </td>
</tr>
</table> </td>
</tr>
<tr>
<td align="right">
<font color="#FF0000" size="2px"><b>IP: </b><?=$ip ?></font>
</font> <font size="2px">
[
<a href="#">
แจ้งลบ </a>
]
<? if($_SESSION['level']=="0"){
?>
[
<a href="#">
ลบ </a>
]
<?
}
?>
<br /><br />
</font> </td>
</tr>
</table> </td>
</tr>
</table>
-->
</div> </td>
</tr>
<?
if($_SESSION['level']<>""||$_SESSION['level']<>null){
?>
<tr>
<td> </td>
</tr>
<tr>
<td align="left" class="h3_comment_violet">แสดงความคิดเห็น</td>
</tr>
<?
if($_SESSION['level']=='2'){
$email1 = $_SESSION['email'];
$comname1 = $_SESSION['id_name'];
}
else{
$sql3 = sprintf("select * from km_member where username = '$_SESSION[username]'",mysql_real_escape_string($_SESSION[username]));
$result3 = mysql_db_query($dbname,$sql3) or die('SQL ERROR');
while($row3 = mysql_fetch_array($result3)){
$com_name = $row3[id_name];
$email = $row3[email];
}
}
?>
<tr>
<td> </td>
</tr>
<tr>
<td>
<form id="frmComment" name="frmComment" action="insert_comment.php" method="post" onsubmit="return chknull();">
<table width="686px" border="0" cellspacing="0" cellpadding="0" bgcolor="#FFFFF2" style="border:1px solid #CBB945;">
<tr>
<td height="20px" class="comment_box"><b>ผู้ตอบ</b></td>
</tr>
<tr>
<td height="20px" align="left" class="comment_box">
<input id="com_name" name="com_name" type="text" value="<? if($_SESSION['level']=='2'){echo $comname1;}else{echo $com_name;}?>" readonly="true" style="width:250px;background-color:#FFFADB;border:1px solid #CBB945;" /> * </td>
</tr>
<tr>
<td height="20px" class="comment_box"><b>อีเมล</b></td>
</tr>
<tr>
<td height="20px" align="left" class="comment_box">
<input id="email" name="email" type="text" value="<? if($_SESSION['level']=='2'){echo $comname1;}else{echo $com_name;}?>" readonly="true" style="width:250px;background-color:#FFFADB;border:1px solid #CBB945;" /> * </td>
</tr>
<tr>
<td height="20px" class="comment_box"><b>ความคิดเห็น</b></td>
</tr>
<tr>
<td height="20px" align="left"> </td>
</tr>
<tr>
<td height="160px" align="left" class="comment_box">
<textarea class="FCKeditor" name="detail" id="detail" style="background-color: rgb(255, 255, 238); font-family: MS Sans Serif; font-size: 10pt; border-style: solid;
border-width: 1px;" cols="54" rows="12" ></textarea>
* </td>
</tr>
<tr>
<td height="10px" align="left"></td>
</tr>
<tr>
<td height="30px" valign="middle" align="left">
<IMG SRC="./captcha/captcha.php" BORDER="0">
</td>
</tr>
<tr>
<td class="comment_box" height="30px" valign="middle" align="left">
<INPUT TYPE="text" NAME="strCheck" id="strCheck" style="width:150px;background-color:#FFFADB;border:1px solid #CBB945;" /> *
<INPUT TYPE="hidden" NAME="hidd" id="hidd" />
</td>
</tr>
<tr>
<td height="10px" align="left"></td>
</tr>
<tr>
<td height="30px" valign="bottom" align="left">
<input id="btnsubmit" name="btnsubmit" type="submit" value="เพิ่มความคิดเห็น" />
<input type="hidden" value="<?=$enid?>" name="id"> </td>
</tr>
<tr>
<td> </td>
</tr>
</table>
</form> </td>
</tr>
<?
}
?>
<tr>
<td> </td>
</tr>
<tr>
<td> </td>
</tr>
<tr>
<td> </td>
</tr>
</table>
<br />
<br />
</td>
</div><!-- close div content -->
</tr>
<div id="footer">
<tr>
<td colspan="2" align="center"><? include "footter.php"; ?></td>
</tr>
</div>
</table>
</body>
</html>
<?
mysql_close($link);
ob_end_flush();
?>
เป็นมือใหม่ครับ ไม่เคยทำด้านนี้ ไม่รู้ว่าผิดตรงไหน? ใครเคยเจอบ้าง?
** เวลาทดสอบ ส่งค่า id=1 and 1=2 union all select 1,database(),3,4,5,6-- (โชว์ชื่อดาต้าเบสออกมาเลย)
T_T
Tag : PHP, MySQL, JavaScript, CakePHP
|
|
|
 |
 |
 |
 |
| Date :
2010-11-05 11:01:46 |
By :
lCeng |
View :
1363 |
Reply :
2 |
|
 |
 |
 |
 |
|
|
|
|
 |
 |
|
 |
 |
| |
|
|
|
| |
|
คุณใช้ sprintf ไม่ถูก
ถ้าถูกต้อง การต่อ string sql command กับตัวแปรโดยตรงจะไม่มีเลย จริงๆ '$id' ใน query string จะต้องเป็น '%s'
|
| |
|
|
| |
| Date :
2010-11-05 11:27:19 |
By :
... |
|
|
| |
|
|
|
|
|
| |
|
|
|
| |
|
|
|
| |
|
ขอบคุณครับ ได้ล่ะ
|
| |
|
|
| |
| Date :
2010-11-05 15:04:09 |
By :
lCeng |
|
|
| |
|
|
|
|
|
| |
|
|
|
|
|
| |
|
 Load balance : Server 01
|
