服务器端验证不起作用

Question

我有表单与客户端验证的jQuery，这工作得很好。但现在出于安全原因，我想为没有JavaScript的用户添加服务器端验证(php)。我创建了几个函数和数组"errors"，其中错误被记录。提交后，我想运行验证。如果没有记录错误，则继续;如果有错误，则退出脚本。但这部分不工作，它总是继续。我的脚本:

if (isset($_POST['submit'])) {
        require_once 'verify_form.php';
        $errors = array(
            'username' => null,
            'password1' => null,
            'password2' => null,
            'email1' => null,
            'email2' => null,
            'age' => null
        );
        validate_all($errors);
        if(empty($errors['username']) && empty($errors['password1']) && empty($errors['password2']) && empty($errors['email1']) && empty($errors['email2']) && empty($errors['age'])) {
//do something
        } else {
            $_SESSION['errorsArray'] = $errors;
            header('Location: /registracia');
            exit;
        }  
    } 

verify_form.php

<?php
function validate_all($errors)
{
    validUsername($errors);
    validPassword1($errors);
    validPassword2($errors);
    validEmail1($errors);
    validEmail2($errors);
    validAge($errors);
}
function validUsername($errors)
{
    include 'config.php';
    $username=$_POST['usernameReg'];
    if (strlen($username) < 3 || strlen($username) > 16) {
        $errors['username'] = "Zadajte uživateľské meno v rozmedzí 3 - 16 znakov.";
    } 
        $query = "SELECT * FROM `users` WHERE `username` = '$username'";
        $result = mysqli_query($link, $query) or die(mysqli_error($link));
        if (mysqli_num_rows($result) > 1) {
            $errors['username'] = "Toto uživateľské meno už niekto používa.";
    }
}
function validPassword1($errors)
{
    $password1=$_POST['password1Reg'];
    $regex = '/^([a-zA-Z]|[0-9]|[-]|[_]|[/]|[.])+([a-zA-Z]|[0-9]|[-]|[_]|[/]|[.])+([a-zA-Z]|[0-9]|[-]|[_]|[/]|[.])$/';
    if (!preg_match($regex, $password1)) {
        $errors['password1'] = 'Vaše heslo obsahuje nepovolené znaky.';
    }
    if (strlen($password1) < 6) {
        $errors['password1'] = 'Heslo musí obsahovať minimálne 6 znakov.';
    }
}
function validPassword2($errors)
{
    $password2=$_POST['password2'];
    if ($password1 != $password2) {
        $errors['password2'] = 'Zadané heslá sa nezhodujú.';
    }
}
function validEmail1($errors)
{
    include 'config.php';
    $email1=$_POST['email1'];
    $regex = "/[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?/";
    if (!preg_match($regex, $email1)) {
        $errors['email1'] = 'Neplatná e-mailová adresa.';
    }
    $query = "SELECT * FROM `users` WHERE `email` = '$email1'";
    $result = mysqli_query($link, $query) or die(mysqli_error($link));
    if (mysqli_num_rows($result) > 1) {
        $errors['email1'] = "Tento e-mail už niekto používa.";
    }
}
function validEmail2($errors)
{
    $email2=$_POST['email2'];
    if ($email1 != $email2) {
        $errors['email2'] = 'Zadané e-maily sa nezhodujú.';
    }
}
function validAge($errors)
{
    $age=$_POST['age'];
    $regex = "/^([0-9]|[0-9][0-9])$/";
    if (!preg_match($regex, $age)) {
        $errors['age'] = 'Vek musí byť číslo v rozsahu od 0-99.';
    }
}


?>

为什么脚本总是继续?

Answer 1

您正在将$errors数组传递给validUsername()函数。该函数实际上并不接收原始数组，而是获取它的副本。你在修改副本，但原件从未被修改过。下面是一个较小的示例，向您展示它是如何工作的:

function addCheese(Array $arr)
{
    $arr[] = 'cheese';
}
$a = array();
addCheese($a);
var_dump($a);
// Outputs:
// array(0) {
// }

解决这个问题的一种方法是修改每个验证函数，使其返回修改后的数组:

function validSomething($errors)
{
    // ... do validation checks
    return $errors;
}

…然后将更新后的版本赋值给外部值:

function validate_all($errors)
{
    $errors = validUsername($errors);
    $errors = validPassword1($errors);
    $errors = validPassword2($errors);
    $errors = validEmail1($errors);
    $errors = validEmail2($errors);
    $errors = validAge($errors);
    return $errors;
}

或者，您可以返回错误的局部数组并将它们组合在一起，或者只是通过引用传递(尽管这可能会在稍后导致其他问题)。

我强烈建议使用某种框架来进行验证:从长远来看，这将为您节省大量时间。

Answer 2

函数validmail2 ($errors)没有意义…= $_POST['email2']

Answer 3

您需要为有效函数提供指向$errors的指针。例如

函数validUsername(和错误美元)