时间戳

首页 > 解决方案 > JavaScript 变量到 SQL

javascript - JavaScript 变量到 SQL

问题描述

我有一个 PHP 页面，它从前一页面获取 PHP 变量以将 hh:mm 转换为秒。然后我将 JS 变量添加到 PHP 变量中，所有这些都在同一页面上，以及许多其他要插入到 DB 中的变量。问题是当我执行 SQL 查询以将其保存到数据库时，存储的值为“0”。如果我回显 PHP 变量，我会得到假定的值。例子：

<script>
    var hms = '<?php echo $_POST['ptimeflown'];?>';
    var a = hms.split(':');
    var seconds = (+a[0]) * 60 * 60 + (+a[1]) * 60;
</script>

$ptimeflown = "<script>document.writeln(seconds);</script>";

假设时间是 01:00。

如果我echo $ptimeflown;得到“3600”，但如果我将该变量存储到数据库中，mysqli_query($db,"INSERT INTO pendingflights (hoursflown) VALUES ('$ptimeflown');");我会在数据库中得到值“0”。

有什么建议吗？

编辑：包括所有代码。

<script>
    var hms = '<?php echo $_POST['ptimeflown'];?>';
    var a = hms.split(':');
    var seconds = (+a[0]) * 60 * 60 + (+a[1]) * 60; 
</script>

<?php

include "../config.php";

$pcallsign = $_POST['pcallsign'];
$pflight_number = $_POST['pflightnumber'];
$paircraft_reg = $_POST['paircraft_reg'];
$pdeparture = $_POST['pdeparture'];
$pdestination = $_POST['pdestination'];
$ptimeflown = "<script>document.writeln(seconds);</script>";
$pdistance = $_POST['pdistance'];
$pdate = $_POST['pdate'];
$premarks = $_POST['premarks'];

$target_dir = "uploads/pireps/";
$target_file = $target_dir . basename($_FILES["ptracker"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));

if (isset($_POST["send"])) {

    $check = getimagesize($_FILES["ptracker"]["tmp_name"]);

    if ($check !== false) {
        $uploadOk = 1;
    } elseif ($check !== true) {
        print "File error: not an image.";
        $uploadOk = 0;
    } elseif (file_exists($target_file)) {
        print "File error: file already exists.";
        $uploadOk = 0;
    } elseif ($_FILES["ptracker"]["size"] > 1000000) {
        print "File error: your file is too large (max. 1MB).";
        $uploadOk = 0;
    } elseif ($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif") {
        print "File error: only JPG, JPEG, PNG & GIF files are allowed.";
        $uploadOk = 0;
    }

    if ($uploadOk == 0) {
        print "There was some error submitting this manual pirep. Please contact the IT department.";
    } else {
        move_uploaded_file($_FILES["ptracker"]["tmp_name"], $target_file);
        print "The file ". htmlspecialchars(basename( $_FILES["ptracker"]["name"])). " has been uploaded.";
        mysqli_query($db,"INSERT INTO pendingflights (flight_number,callsign,departure,destination,fpm,distance,fuel_used,fuel_remaining,aircraft_reg,datetime,hoursflown,tracker_image,remarks,mp)
                              VALUES ('$pflight_number','$pcallsign','$pdeparture','$pdestination','0','$pdistance','0','0','$paircraft_reg','$pdate','$ptimeflown','$target_file','$premarks','1');");
        mysqli_query($db,"DELETE FROM bookedflights WHERE callsign='$pcallsign'");
    }
}

?>

标签： javascriptphpsql

解决方案

像这样$ptimeflown = "<script>document.writeln(seconds);</script>";的行只是垃圾代码，这是行不通的。您从中“获取”一个值的唯一原因是，如果您echo将其放入文档并在浏览器中运行它，那么您将获得一个<script>被评估的标签，但这发生在客户端。

您已经有效地为您的页面注入了脚本。

就服务器而言，$ptimeflown只是一些随机垃圾，当插入数据库时​​评估为（数字上）0。

我假设您可以将其展平，删除 JavaScript 偏移，然后继续：

<?php
$times = explode(':', $_POST['ptimeflown']);
$ptimeflown = $times[0] * 60 * 60 + $times[1] * 60;
?>

explode().php 的等价物在哪里split()？现在你有了一个可以使用的值。

推荐阅读