PHP表单及验证
一、概述
PHP在处理一个页面时,它都会检查URL和表单变量、上传的文件、可用的cookie以及Web服务器和环境变量。之后,这些信息就可以通过下面这些数组直接访问:$_GET、$_POST、$_FILES、$_COOKIE、$_SERVER和$_ENV。也就是说,PHP会分别保存在查询字符串中设置的变量、一个post请求的主题内容、上传的文件、cookie、Web服务器及Web服务器运行其上的环境等这些信息。当然,也有一个$_REQUEST变量,它是包含着前面六个数组中全部值的一个大数组。
variables_order
当在$_REQUEST数组中放置元素时,如果两个数组都有一个同名的键,PHP会根据php.ini中的variables_order配置指令决定如何切断他们之间的联系。在默认情况下,variables_order的值是EGPCS(如果使用的是php.ini-recommended配置文件,则是GPCS)。也就是说,PHP首先会把环境变量添加到$_REQUEST中,然后再依次添加查询字符串(get)、post、cookie、和web服务器变量。在这种情况下,因为默认是C在P的后面,所以一个名为username的cookie会覆盖一个同样名为username的post变量。注意,php.ini-recommended文件中的GPCS值表明$_ENV数组中的环境变量不会被添加到$_REQUEST数组中。
track_vars
在PHP4.1之前,这些自动全局变量是不存在的。当时,它们只是一些常规的数组,名字分别为$HTTP_COOKIE_VARS、$HTTP_ENV_VARS、$HTTP_GET_VARS、$HTTP_POST_VARS、$HTTP_POST_FILES和$HTTP_SERVER_VARS。出于继承的原因,这些数组仍然是有效的,只不过新增加的数组更容易使用。这些老数组只有在track_vars配置指令为on时才会被赋值。(此选项自php4.0.3后总是开启的,不再通过track_vars=设置)
register_globals
如果register_globals配置指令的值是on,那么以上所有的变量同样也将作为全局名称空间中的变量。所以$_GET['password']的值也可以使用$password访问。这样虽然方便,但却也引入了较大的安全问题。自PHP 4.2起,register_globals的默认值为off。
以上是PHP表单提交数据时涉及的相关知识的一些简单介绍。为了保证PHP代码的安全,PHP表单处理程序不能忽略两个很重要的步骤:数据验证和输出转义。保证输入的信息对程序是可以接受的;保证恶意用户不会利用你的网站攻击其他的网站。
二、数据验证
需牢记的几点:
1、所有接收的数据不一定如你前端(html及javascript)约束的那样,可能会是来自电脑黑客通过手工构造的数据请求或恶意用户发现你程序漏洞的请求。
2、不同类型的表单元素留空会导致$_GET和$_POST中的元素值不尽相同。空文本框、空文本区域及空的文件上传字段的值是零长度字符串。而未选中的复选框和单选按钮,不会在$_GET和$_POST中生存任何值。浏览器通常会强迫在单选下拉列表选中一个项目,而对于多选下拉列表,如果没有选择其中的任何项,那么结果和复选框是一样的,即不会在$_GET和$_POST中生存任何值。
3、$_GET和$_POST中的值始终是字符串。例如,某人在text_price文本框中填入02201并提交了表单,那么$_POST['text_price']的值会是五位的字符串“02201”,而不是整数2201。
验证实例
1、验证必填项
使用strlen()来测试$_GET或$_POST中的元素值。出于某种偏好,很多人常用empty()代替strlen()来测试一个文本框中是否填写了值。但根据PHP的布尔值计算规则,字符0可以转换为FALSE,因此这常常会导致问题出现。例如,有人在total_val文本框中填入了0,而empty($_POST['total_val'])测试的结果会是TRUE。显然,从表单验证的角度来看这是错误的。
?
<?php if (! strlen($_POST['keyname']) { echo 'keyname is null'; } ?>
?
2、数字验证
A、判断是否大于或等于零的整数,直接用ctype_digit()函数判断。
<?php if (! ctype_digit($_POST['keyname']) { echo 'Your keyname must be a number bigger than or equal to zero.'; } ?>
在PHP数字验证中一种常见的做法是用is_numeric()函数来验证数字。遗憾的是,is_numeric()所认为的数字更符合计算机的特点而不是人的思维。比如说,十六进制的数字字符串0xCAFE和带指数符号的数字字符串10e40对于is_numeric()来说都是数字。
在PHP5.1之前,如果向ctype_digit()传递一个空字符串,它会返回TRUE;显然这不是我们要的结果,因此首先要验证下它是否为空。
<?php if (! strlen($_POST['keyname']) && ! ctype_digit($_POST['keyname']) { echo 'Your keyname must be a number bigger than or equal to zero.'; } ?>
?
B、判断是否为正整数或负整数,可以采用提交值与值在转换成证书之后返回的字符串进行比较。
1)类型转换法验证整数
<?php if ($_POST['keyname'] != strval(intval($_POST['keyname']))) { echo 'Your keyname must be an integer.'; } ?>
? intval('025')返回25,intval('-2300')返回-2300, intval('2.2')返回2, intval('-8.8')返回-8, intval('sdf')返回0.
2)类型转换法验证小数
<?php if ($_POST['keyname'] != strval(floatval($_POST['keyname']))) { echo 'Your keyname must be an number.'; } ?>
?
floatval('3.025')返回3.025,floatval('-23.007')返回-23.007 floatval('sdf')返回0.
3、正则表达式验证
1)字符串中只能包含数字
<?php $str = "0238"; if (preg_match('/^\d+$/', $str)) { echo 'match'; } ?>?
2)检验PHP变量名是否符合规范
<?php function pregPHPVar($str) { if (preg_match('/\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*/', $str)) { return 'match'; } else { return 'mismatch'; } } echo prefPHPVar('$str'); // print match; echo prefPHPVar('$1str'); // print mismatch; ?>?
3)邮箱验证
<?php $email = "your.name@domain.name.info"; if (! preg_match('/^[^0-9][a-zA-Z0-9_]+([.][a-zA-Z0-9_]+)*[@][a-zA-Z0-9_]+([.][a-zA-Z0-9_]+)*[.][a-zA-Z]{2,4}$/', $email)) { echo 'Email is invalid.'; } ?>?
?
?
?

What’s still popular is the ease of use, flexibility and a strong ecosystem. 1) Ease of use and simple syntax make it the first choice for beginners. 2) Closely integrated with web development, excellent interaction with HTTP requests and database. 3) The huge ecosystem provides a wealth of tools and libraries. 4) Active community and open source nature adapts them to new needs and technology trends.

PHP and Python are both high-level programming languages that are widely used in web development, data processing and automation tasks. 1.PHP is often used to build dynamic websites and content management systems, while Python is often used to build web frameworks and data science. 2.PHP uses echo to output content, Python uses print. 3. Both support object-oriented programming, but the syntax and keywords are different. 4. PHP supports weak type conversion, while Python is more stringent. 5. PHP performance optimization includes using OPcache and asynchronous programming, while Python uses cProfile and asynchronous programming.

PHP is mainly procedural programming, but also supports object-oriented programming (OOP); Python supports a variety of paradigms, including OOP, functional and procedural programming. PHP is suitable for web development, and Python is suitable for a variety of applications such as data analysis and machine learning.

PHP originated in 1994 and was developed by RasmusLerdorf. It was originally used to track website visitors and gradually evolved into a server-side scripting language and was widely used in web development. Python was developed by Guidovan Rossum in the late 1980s and was first released in 1991. It emphasizes code readability and simplicity, and is suitable for scientific computing, data analysis and other fields.

PHP is suitable for web development and rapid prototyping, and Python is suitable for data science and machine learning. 1.PHP is used for dynamic web development, with simple syntax and suitable for rapid development. 2. Python has concise syntax, is suitable for multiple fields, and has a strong library ecosystem.

PHP remains important in the modernization process because it supports a large number of websites and applications and adapts to development needs through frameworks. 1.PHP7 improves performance and introduces new features. 2. Modern frameworks such as Laravel, Symfony and CodeIgniter simplify development and improve code quality. 3. Performance optimization and best practices further improve application efficiency.

PHPhassignificantlyimpactedwebdevelopmentandextendsbeyondit.1)ItpowersmajorplatformslikeWordPressandexcelsindatabaseinteractions.2)PHP'sadaptabilityallowsittoscaleforlargeapplicationsusingframeworkslikeLaravel.3)Beyondweb,PHPisusedincommand-linescrip

PHP type prompts to improve code quality and readability. 1) Scalar type tips: Since PHP7.0, basic data types are allowed to be specified in function parameters, such as int, float, etc. 2) Return type prompt: Ensure the consistency of the function return value type. 3) Union type prompt: Since PHP8.0, multiple types are allowed to be specified in function parameters or return values. 4) Nullable type prompt: Allows to include null values and handle functions that may return null values.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Safe Exam Browser
Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Atom editor mac version download
The most popular open source editor

Notepad++7.3.1
Easy-to-use and free code editor

Zend Studio 13.0.1
Powerful PHP integrated development environment