删除脚本

我制作了一个脚本来删除游戏中的角色。它工作起来很艰难。但似乎任何拥有随机帐户(不拥有该角色)的人都可以删除它们。它正确检查密码，密码等，只是它不会检查字符名称以匹配脚本上使用的玩家ID。

我希望这里的任何人都能帮助我。

这是脚本

我已经尝试添加字符名检查，但它在另一个表中，我不知道该怎么做。

这是基本的索引删除页面

<?php
include "config.php";
echo $_GET['error'];
?>
<form action="delete_char.php" method="post">
<table>
Please enter the required information to delete your character<br><br>
<tr><td>Character Name: <br /></td><td><input name="char_name" type="text" maxLength=10 size=13/><br />
<tr><td>Account: <br /></td><td><input name="use" type="text" maxLength=13 size=13/><br />
<tr><td>Password: <br /></td><td><input name="acc_pass" type="password" maxLength=10 size=13/><br />
<tr><td>PIN: <br /></td><td><input name="pin" type="text" maxLength=6 size=13/><br />
<tr><td colspan="2"><input type="submit" value="Ok"/></td></tr>
</table>
</form>

这是脚本。

<?php
include "config.php";
$char_name = $_POST['char_name'];
$use = $_POST['use'];
$acc_pass = $_POST['acc_pass'];
$pin = $_POST['pin'];
$con = mysql_connect($host, $user, $pass);
mysql_select_db($db);
$query = mysql_query("SELECT SSN, Password FROM Player WHERE PlayerID='$use'");
$row = mysql_fetch_array($query);
$count = mysql_num_rows($query);
$q = mysql_query("SELECT PASSWORD('$acc_pass') AS Password");
$p = mysql_fetch_array($q);
if($count == "0") {
$error = "Account not found!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
else {
if($p['Password'] != $row['Password']) {
$error = "Invalid password!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
if($row['LogOn'] == "GAME") {
$error = "Account is logged on!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
if($pin != $row['SSN']) {
$error = "Invalid PIN Number!<hr size=2><br>";
header("Location: delete.php?error=$error");
}
else {
$q = mysql_query("SELECT CurrentWorldID FROM Player WHERE Name = '$use'");
$world_id = mysql_fetch_array($q);
$world_id = $world_id['CurrentWorldID'];
$del_query = mysql_query("DELETE FROM Slayer WHERE Name = '$char_name'");
$del_query = mysql_query("INSERT INTO DeleteChar (PlayerID, WorldID, Name, delDate) VALUES ('$use',$world_id,'$char_name',now())");
$del_query = mysql_query("DELETE FROM Vampire WHERE Name = '$char_name'");
$del_query = mysql_query("DELETE FROM Ousters WHERE Name = '$char_name'");
$del_query = mysql_query("DELETE FROM SkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireSkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersSkillSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RankBonusData WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM FlagSet WHERE OwnerID='$char_name'");
$del_query = mysql_query("DELETE FROM ARObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BeltObject WHERE OwnerID = '$char_name");
$del_query = mysql_query("DELETE FROM BladeObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BloodBibleObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BombMaterialObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BombObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM BraceletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CastleSymbolObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CrossObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventGiftBoxObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventStarObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventTreeObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GloveObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM HelmObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM HolyWaterObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM KeyObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LearningItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MagazineObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MineObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MoneyObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MotorcycleObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM NecklaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PotionObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM QuestItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RelicObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SMGObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SRObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SerumObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShieldObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShoesObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SkullObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SlayerPortalItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SwordObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TrouserObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM RingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireAmuletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireBraceletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireCoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireETCObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireEarringObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireNecklaceObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampirePortalItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireWeaponObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM VampireCoupleRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM WaterObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM DyePotionObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ResurrectItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MixingItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersArmsbandObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersBootsObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersChakramObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersCircletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersCoatObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersPendentObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersRingObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersStoneObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersWristletObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LarvaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PupaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ComposMeiObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM OustersSummonItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CodeSheetObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MoonCardObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SweeperObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetFoodObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PetEnchantItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM LuckyBagObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SMSItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoreZapObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GQuestItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM GQuestSave WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TrapItemObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CarryingReceiverObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM ShoulderArmorObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM DermisObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM PersonaObject WHERE OwnerID = '$char_name");
$del_query = mysql_query("DELETE FROM FasciaObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MittenObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM SubInventoryObject WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleInfo WHERE FemalePartnerName = '$char_name'");
$del_query = mysql_query("DELETE FROM CoupleInfo WHERE MalePartnerName = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectAcidTouch WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectAftermath WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectBloodDrain WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectDetectHidden WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectFlare WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectLight WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectParalysis WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectPoison WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectPoisonousHands WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectProtectionFromParalysis WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectProtectionFromPoison WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectRestore WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectYellowPoisonToCreature WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EffectMute WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EnemyErase WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM TimeLimitItems WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM EventQuestAdvance WHERE OwnerID = '$char_name'");
$del_query = mysql_query("DELETE FROM MofusPowerPoint WHERE OwnerID = '$char_name'");
$OK = "Character $char_name has been deleted.<hr size=2><br>";
header("Location: delete.php?error=$OK");
}
}
mysql_close($con);

好吧，脚本工作正常。

我希望脚本检查使用玩家ID验证Char_name，以便只有所有者可以删除它。

header

不会立即结束脚本，即使重定向也是如此。您需要exit或执行其他操作来阻止后续代码运行。在当前代码中，检查密码和LogOn值if设置重定向标头，但不会阻止 MySQL 代码运行。这可以通过使用elseif来解决，因此您可以获得if..elseif..elseif..else(delete stuff)应该没问题。

但是，我想提出一些您应该修改的内容。

您将值直接注入到查询中。如果我以Niet' OR 1=1; --提交我的角色名称，那么我只是对你的整个数据库进行了pwn。早就该将代码更新为 PDO 并使用预准备语句了。
您似乎正在使用不安全的方法来存储密码。应使用password_hash()和password_verify()来保护和验证密码。
您正在手动运行大量删除查询。这表明您的数据库未以正确的关系方式设置。使用FOREIGN KEY约束使每个表强制与拥有它们的OwnerID建立适当的关系。这样，当您删除(或更新)Slayer记录时，该记录拥有的所有元素都将被删除(或更新)。这意味着您可以稍后添加更多内容，而无需记住返回此代码并添加它。
您似乎使用任意字符串值(名称)作为表的键。相反，您应该将类似INT UNSIGNED AUTO_INCREMENT的东西作为主键 - 特别是这将允许您重命名Slayer，而无需更新指向该名称的每个内容。

希望这有帮助！

相关内容

最新更新

热门标签：