Пожалуйста помогите мой код вводит дубликаты записей
<?php include('functionS.php');?> <?php $username = ""; $email = ""; $errors = array(); // connect to db $db = mysqli_connect('localhost', 'root', '', 'registration'); // when register button is clicked if (isset($_POST['register'])) { $username = mysqli_real_escape_string($db,$_POST['username']); $email = mysqli_real_escape_string($db,$_POST['email']); $password_1 = mysqli_real_escape_string($db,$_POST['password_1']); $password_2 = mysqli_real_escape_string($db,$_POST['password_2']); //ensure that form fields are filled properly (validation) if(empty($username)){ array_push($errors, "Username is required"); } if(empty($email)){ array_push($errors, "Email is required"); } if(empty($password_1)){ array_push($errors, "Password is required"); } if($password_1 != $password_2){ array_push($errors, "The two passwords do not match"); } //if error free , save user to database if (count($errors) == 0){ $password = md5($password_1); // encrypt password before storing in db(security) $sql = "INSERT INTO users (username, email, password) VALUES ('$username','$email','$password')"; mysqli_query($db, $sql); $_SESSION['username'] = $username; $_SESSION['success'] = "You are now logged in"; header('location: index.php'); // back to home page } } // log user in system if (isset($_POST['login'])){ $username = mysqli_real_escape_string($db,$_POST['username']); $password = mysqli_real_escape_string($db,$_POST['password']); //ensure that form fields are filled properly (validation) if(empty($username)){ array_push($errors, "Username is required"); } if(empty($password)){ array_push($errors, "Password is required"); } if (count($errors) == 0) { $password = md5($password); // encrypt password before comparison $query = "Select * FROM users WHERE username = '$username' AND password = '$password'"; $result = mysqli_query($db, $query); } if (mysqli_num_rows($result) == 1) { //log user in $_SESSION['username'] = $username; $_SESSION['success'] = "You are now logged in"; header('location: index.php'); // back to home page } } // logout if (isset($_GET['logout'])) { session_destroy(); unset($_SESSION['username']); header('location: login.php'); } // register event if (isset($_POST['create_event'])) { $Event = mysqli_real_escape_string($db,$_POST['Event']); $Venue = mysqli_real_escape_string($db,$_POST['Venue']); $Host= mysqli_real_escape_string($db,$_POST['Host']); $Date = mysqli_real_escape_string($db,$_POST['Date']); $Start_time = mysqli_real_escape_string($db,$_POST['Start_time']); $Duration = mysqli_real_escape_string($db,$_POST['Duration']); $Entry_fee = mysqli_real_escape_string($db,$_POST['Entry_fee']); $Dress_code = mysqli_real_escape_string($db,$_POST['Dress_code']); $Ticket_purchase = mysqli_real_escape_string($db,$_POST['Ticket_purchase']); $Social_media_link = mysqli_real_escape_string($db,$_POST['Social_media_link']); //ensure that form fields are filled properly (validation) if(empty($Event)){ array_push($errors, "Event is required"); } if(empty($Venue)){ array_push($errors, "Venue is required"); } if(empty($Host)){ array_push($errors, "Host is required"); } if(empty($Date)){ array_push($errors, "Date is required"); } if(empty($Start_time)){ array_push($errors, "Start_time is required"); } if(empty($Duration)){ array_push($errors, "Duration is required"); } if(empty($Entry_fee)){ array_push($errors, "Entry_fee is required"); } if(empty($Dress_code)){ array_push($errors, "Dress_code is required"); } if(empty($Ticket_purchase)){ array_push($errors, "Ticket_purchase is required"); } if(empty($Social_media_link)){ array_push($errors, "Social_media_link is required"); } //if error free , save user to database if (count($errors) == 0){ $sql1 = "INSERT INTO events (Event, Venue, Host, Date, Start_time, Duration, Entry_fee, Dress_code, Ticket_purchase, Social_media_link) VALUES ('$Event','$Venue','$Host','$Date','$Start_time','$Duration','$Entry_fee','$Dress_code','$Ticket_purchase','$Social_media_link')"; $result = mysqli_query($db, $sql1); } } ?>
Что я уже пробовал:
игнорировать и заменять код
Richard Deeming
Ваш код уязвим для SQL-инъекция[^]. НИКОГДА используйте конкатенацию строк / интерполяцию для построения SQL-запроса. ВСЕГДА используйте параметризованный запрос.
PHP: SQL-инъекция - руководство пользователя[^]
РНР: Подготовленные инструкции и хранимые процедуры - руководство пользователя[^]
Кроме того, вы храните пароли в виде несоленого хэша MD5. Не делайте этого - MD5 уже много десятилетий не считается "безопасным". PHP имеет встроенные функции, которые помогут вам сделать все правильно:
PHP: password_hash[^]
РНР: функцию password_verify[^]