PHP：针对数据库表的Textarea输入验证

Question

I am attempting to validate a textarea input against a database table. If any of the entries exists, the form is rejected. If no entry is found, then form is accepted and textarea input entered into the database table with each linebreak going to a new row.

I am having trouble though, the following script seems to skip the validation portion and goes straight to just adding the textarea input into the database.

<?php
if (isset($_GET["submit"])) {
}

$host = "localhost";
$user = "root";
$password = "password";
$database = "test";
// Establish server connection and select database
$dbh = mysqli_connect($host, $user, $password, $database);
  if (mysqli_connect_errno()) {
  die('Unable to connect to database ' . mysqli_connect_error());
  }
  else {
      $text = trim($_POST['serial']);
      $textAr = explode("
", $text);
      $textAr = array_filter($textAr, 'trim'); // remove any extra  chars
      foreach ($textAr as $line) {
               $query = mysqli_query($dbh, "SELECT serials FROM `wp27_test6serial` WHERE `serials` = '$line'");
               $result = mysqli_query($dbh, $query);
           if (mysqli_num_rows($result) > 0) {
                     die('entry already exists');
            }
           else {
                     $query = mysqli_query($dbh, "INSERT INTO wp27_test6serial (rtxserials) VALUES ('$line')");
                     echo ('serials submitted');
                }
            }
   }

Can anyone tell me what is wrong with the script and why it is not validating before moving onto inserting the textarea string into the database?

Thank you

Answer 1

You are querying twice.

$query = mysqli_query($dbh, "SELECT serials FROM `wp27_test6serial` WHERE `serials` = '$line'");

Should be

$query = "SELECT serials FROM `wp27_test6serial` WHERE `serials` = '$line'";

And your code is vunerable to SQL Injection attack. Use prepared statements.