form表单demo:task.html
header("Content-type: text/html; charset=utf-8");
if(!empty($_POST)){
$db_config = array(
"db_host"=>"127.0.0.1",/*数据库地址,我这是本地的*/
"db_username"=>"root",/*数据库登录名*/
"db_userpwd"=>"As123456789",/*数据库登录密码*/
"db_database"=>"test",/*数据库名*/
"db_charset"=>"utf8"/*数据库字符集*/
);
$conn = new Mysqli($db_config["db_host"],$db_config["db_username"],$db_config["db_userpwd"],$db_config["db_database"]) or die("连接数据库失败");/*链接数据库*/
$conn->set_charset($db_config["db_charset"]);/*设置字符集*/
$name = check_input($_POST['name']);
$sex = check_input($_POST['sex']);
$age = check_input($_POST['age']);
$phone = check_input($_POST['phone']);
$qq = check_input($_POST['qq']);
$email = check_input($_POST['email']);
$sql = "INSERT INTO user (`test_name`,`test_sex`,`test_age`,`test_phone`,`test_qq`,`test_email`) VALUES('{$name}',$sex,$age,'{$phone}','{$qq}','{$email}')";
$rs = $conn->query($sql);
if($rs){
echo '';
}else{
echo '';
}
}
//php防注入安全过滤函数:
function check_input($data){
//对特殊符号添加反斜杠
$data = addslashes($data);
//判断自动添加反斜杠是否开启
if(get_magic_quotes_gpc()){
//去除反斜杠
$data = stripslashes($data);
}
//把'_'过滤掉
$data = str_replace("_", "\_", $data);
//把'%'过滤掉
$data = str_replace("%", "\%", $data);
//把'*'过滤掉
$data = str_replace("*", "\*", $data);
//回车转换
$data = nl2br($data);
//去掉前后空格
$data = trim($data);
//将HTML特殊字符转化为实体
$data = htmlspecialchars($data);
return $data;
}
?>
追加点悬赏咩~