如果我的网站上有问题,用户可以在空闲时发布空消息.
if (isset($_POST['submit'])) { // check for empty fields if (empty($_POST['headline']) || empty($_POST['text']) || empty($_POST['forum_id'])) { header("Refresh: 2; url=/add-thread"); die('You must fill out every field.'); } // No errors? Save. else { $headline = mysql_real_escape_string($_POST['headline']); $text = mysql_real_escape_string($_POST['text']); mysql_query("INSERT INTO threads (headline, text, date, forum_id, user_id) VALUES ('$headline', '$text', NOW(), '$_POST[forum_id]', '$user[id]')"); header("Location: /thread/".mysql_insert_id().""); } }
我怎样才能解决这个问题?
trim()
文字输入.你可以这样轻松地做到这一点:
// get input vars and trim space $callback = array('filter' => FILTER_CALLBACK, 'options' => 'trim'); $fields = filter_input_array(INPUT_POST, array( 'headline' => $callback, 'text' => $callback, 'forum_id' => $callback, )); // check for empty fields by counting how many are set if ( count($fields) != count(array_filter($fields)) ) { // something was unset }