快速PHP变量指南

Question

I'm a newbie with PHP. I am trying to create a log in /register system for a project, so I am using a login system source code I found which has many functions and features like salted passwords. The system itself works fine, but I am trying to add more fields to my MySQL Table. The system had an array for extra columns, but I think it was resulting in bad mysql syntax so I decided to write out the query myself using the variables, but I am not sure how I can give access to the variables to the function. The variables are in the register.php document, here is the code (all of register.php):

        if( isset($_POST['submit']) ){
            $firstname = $_POST['firstname'];
            $lastname = $_POST['lastname'];
            $user    = $_POST['username'];
            $sex = $_POST['sex'];
            $country = $_POST['strCountryChoice'];
            $email = $_POST['email'];
            $pass    = $_POST['pass'];
            $pass2 = $_POST['pass2'];
            $birthdate = $_POST['birthdate'];
            $created = date("Y-m-d H:i:s");
            //need to add a lot more validation functions.. AKA Check if email exists and username. Password > 5 chars
            if( $user=="" || $email=="" || $pass=='' || $pass2=='' || $firstname=='' || $lastname='' || $sex='' || $country='' || $birthdate='' ){
                echo "Fields Left Blank","Some Fields were left blank. Please fill up all fields.";
                exit;
            }
            if( !$LS->validEmail($email) ){
                echo "E-Mail Is Not Valid", "The E-Mail you gave is not valid";
                exit;
            }
            if( !ctype_alnum($user) ){
                echo "Invalid Username", "The Username is not valid. Only ALPHANUMERIC characters are allowed and shouldn't exceed 10 characters.";
                exit;
            }
            if($pass != $pass2){
                echo "Passwords Don't Match","The Passwords you entered didn't match";
                exit;
            }
        $createAccount = $LS->register($user, $pass,
                array(
                    "email"      => $email,
                    "name"   => $firstname,
                    "lastname" => $lastname,
                    "gender" => $sex,
                    "country" => $country,
                    "DOB" => $birthdate,
                    "created" => date("Y-m-d H:i:s") // Just for testing

                )
            );
            if($createAccount === "exists"){
                echo "User Exists.";
            }elseif($createAccount === true){
                echo "Success. Created account.";
            }
    }

The whole system takes place in another file which has the class. Here is the register function:

public function register( $id, $password, $other = array() ){
    if( $this->userExists($id) && (isset($other['email']) && $this->userExists($other['email'])) ){
        return "exists";
    }else{
        $randomSalt = $this->rand_string(20);
        $saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");

        if( count($other) == 0 ){
            /* If there is no other fields mentioned, make the default query */
            //old query: ("INSERT INTO `{$this->dbtable}` (`username`, `password`, `password_salt`) VALUES(:username, :password, :passwordSalt)");
            //new query: ("INSERT INTO `{$this->dbtable}` (`username`, 'email' , `password`, `password_salt` , 'name' , 'lastname' , 'gender' , 'country' , 'DOB') VALUES(:username, :email, :pass, :passwordSalt, :firstname, :lastname, :gender, :country, :DOB)");
            $sql = $this->dbh->prepare("INSERT INTO `{$this->dbtable}` (`username`, `password`, `password_salt`) VALUES(:username, :password, :passwordSalt)");
        }else{
            /* if there are other fields to add value to, make the query and bind values according to it */
            //old query: ("INSERT INTO `{$this->dbtable}` (`username`, `password`, `password_salt`, $columns) VALUES(:username, :password, :passwordSalt, :$colVals)");
            //new query: ("INSERT INTO `{$this->dbtable}` (`username`, 'email' , `password`, `password_salt` , 'name' , 'lastname' , 'gender' , 'country' , 'DOB') VALUES(:username, :email, :pass, :passwordSalt, :firstname, :lastname, :gender, :country, :DOB)");
            $keys    = array_keys($other);
            $columns = implode(",", $keys);
            $colVals = implode(",:", $keys);
        //l= $this->dbh->prepare("INSERT INTO `{$this->dbtable}` (`username`, `password`, `password_salt`, $columns) VALUES(:username, :password, :passwordSalt, :$colVals)");
            //INSERT INTO MyGuests (firstname, lastname, email)cLUES ('John', 'Doe', '[e-mail]')
            $sql = $this->dbh->prepare("INSERT INTO `{$this->dbtable}` (username,email,password,password_salt,name,lastname,created,gender,country,DOB) VALUES ('$username','$email','$pass','$saltedPass','$firstname','$lastname','$created','$gender','$country','$birthdate')");
            print($sql);
            foreach($other as $key => $value){
                $value = htmlspecialchars($value);
                $sql->bindValue(":$key", $value);
            }
        }
        /* Bind the default values */
        $sql->bindValue(":username", $id);
        $sql->bindValue(":password", $saltedPass);
        $sql->bindValue(":passwordSalt", $randomSalt);
        $sql->execute();
        return true;
    }
}

So I need to use the variables from register.php in the class file. Can I just include it at the top or do I need to do something specific to the function?

Thanks. I'm focusing on the $sql line after else.

Answer 1

Yes you can include/require register.php file in the class file to use all the variables.

On another note i would like to mention that you should always filter out the POST data before adding it to the query for security concerns.