漏洞测试作业十：WEB开发实践

题目

复现课本第九章的实验三：利用php编写简单的数据库插入、查询和删除操作的示例

基于课本的完整例子，进一步了解WEB开发的细节

解答

0.php学习

登录界面

<html>
<body>
<form id="form1" method = "post" action="login.php">
	<table width="900" border="0" cellspacing="0">
		<tr>
			<td height="20">姓名</td>
			<td height="20"><label>
				<input name="username" type="text" id="username"/>
			</label></td>
		</tr>
		<tr>
			<td height="20">口令</td>
			<td height="20"><label>
				<input name="pwd" type="password" id="pwd"/>
			</label></td>
		</tr>
		<tr>
			<td height="20">&nbsp;</td>
			<td height="20"><label>
				<input name="submit" type="Submit" value="提交"/>
			</label></td>
		</tr>
	</table>
</form>
</body>
</html>

<?php
$username=$_POST['username'];
$pwd=$_POST['pwd'];
$SQLStr="select * from userinfo where username='$username' and pwd='$pwd'";
echo $SQLStr;
?>

链接数据库

<?php
$conn=mysql_connect("localhost","root","123456");//connect to database
$username=$_POST['username'];
$pwd=$_POST['pwd'];
$SQLStr="select * from userinfo where username='$username' and pwd='$pwd'";
echo $SQLStr;
$result=mysql_db_query("testDB",$SQLStr,$conn);//execute sql
// fetch the result
if($row=mysql_fetch_array($result))
	echo "<br>OK<br>";
else
	echo "<br>false<br>";
//release
mysql_free_result($result);
//close connection
mysql_close($conn);
?>

查询数据

<?php
$conn=mysql_connect("localhost","roor","123456");
$SQLStr="select * from userinfo";
echo $SQLStr;
$result=mysql_db_query("testDB","root","123456");
//获取查询结果
if($rrow=mysql_fetch_array($result))//通过循环读取内容
{
	echo "<br>OK...表内容<br>";
	//定位到第一条记录
	mysql_data_seek($reult,0);
	//循环取出记录
	while($row=mysql_fetch_row($result))
	{
		for($i=0;$i<mysql_num_fields($result);$i++)
		{
			echo $row[$i];
			echo " | ";
		}
		echo "<br>";
	}
}
else
	{echo "<br>false<br>";}
//释放资源
mysql_free_result($result);
//关闭连接
mysql_close($conn);

1.创建数据库和表

创建数据库testDB

创建表news(newsid,topic,content)和userinfo(username,password)

点击保存

2.php文件编写

index.php

cellspacing 单元格间距，cellpadding 补白，是指单元格内文字与边框的距离;

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<title>主页</title>
</head>
<?php
 $conn=mysql_connect("localhost", "root", "123456"); 
?>
<body>
<div align="center">
  <table width="900" border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td height="40"><form id="form1" name="form1" method="post" action="loginok.php">
        <div align="right">用户名：
          <input name="username" type="text" id="username" size="12" />
          密码：
          <input name="password" type="password" id="password" size="12" />
          <input type="submit" name="Submit" value="提交" />
        </div>
      </form>
      </td>
    </tr>
    <tr>
      <td><hr /></td>
    </tr>
    <tr>
      <td height="300" align="center" valign="top"><table width="600" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td width="100" height="30"><div align="center">新闻序号</div></td>
          <td><div align="center">新闻标题</div></td>
        </tr>
<?php 
      $SQLStr = "select * from news";
      $result=mysql_db_query("testDB", $SQLStr, $conn); 
      if ($row=mysql_fetch_array($result))//通过循环读取数据内容  
      { 	   
 	     // 定位到第一条记录
         mysql_data_seek($result, 0);
         // 循环取出记录
         while ($row=mysql_fetch_row($result))
         {  
?>        
 <tr>
          <td height="30"><div align="center"> <?php echo $row[0] ?> </div></td>
          <td> <div align="center"> <a href="news.php?newsid=<?php echo $row[0] ?> " > <?php echo $row[1] ?>   </a> </div></td>
        </tr>
<?php 
         }
       }		
?>
      </table></td>
    </tr>
  </table>
</div>
</body>
</html>

<?php 
    // 释放资源
    mysql_free_result($result);
    // 关闭连接
    mysql_close($conn);  
?>

news.php

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<title>主页</title>
</head> 
<body>
<div align="center">
  <table width="900" border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td height="40"><form id="form1" name="form1" method="post" action="loginok.php">
        <div align="right">用户名：
          <input name="username" type="text" id="username" size="12" />
          密码：
          <input name="password" type="password" id="password" size="12" />
          <input type="submit" name="Submit" value="提交" />
        </div>
      </form>
      </td>
    </tr>
    <tr>
      <td><hr /></td>
    </tr>
    <tr>
      <td height="300" align="center" valign="top"><p>&nbsp;</p>
	 <?php
      $conn=mysql_connect("localhost", "root", "123456"); 
      $newsid = $_GET['newsid'];

      $SQLStr = "select * from news where newsid=$newsid";
      $result=mysql_db_query("testDB", $SQLStr, $conn); 
      if ($row=mysql_fetch_array($result))//通过循环读取数据内容  
      { 	   
 	     // 定位到第一条记录
         mysql_data_seek($result, 0);
         // 循环取出记录
         while ($row=mysql_fetch_row($result))
         {  
             echo "$row[1]<br>";
             echo "$row[2]<br>";
         }
       }
      // 释放资源
      mysql_free_result($result);
      // 关闭连接
      mysql_close($conn);  
       
?>
 </td>
    </tr>
  </table>
</div>
</body>
</html>

loginok.php

	 <?php
 	    $loginok=0;
      $conn=mysql_connect("localhost", "root", "123456");   
      $username = $_POST['username'];
      $pwd = $_POST['password'];
      $SQLStr = "SELECT * FROM userinfo where username='$username' and password='$pwd'"; 
      echo $SQLStr;

      $result=mysql_db_query("testDB", $SQLStr, $conn); 
      if ($row=mysql_fetch_array($result))//通过循环读取数据内容  
      {
      	$loginok=1;
      }
      // 释放资源
      mysql_free_result($result);
      // 关闭连接
      mysql_close($conn);        
      if ($loginok==1)
      {
      	?>
      	<script> 
      		alert("login succes");
      		window.location.href="sys.php";  
      	</script>
      	 <?php
      }
      else{
      	?>
      	<script> 
      		alert("login failed");
      		history.back();  
      	</script>
      	 <?php
      }
       
?>

sys.php

注意，书中的添加新闻表格缺少newsid字段，导致插入失败

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<title>主页</title>
</head>
<?php
 $conn=mysql_connect("localhost", "root", "123456"); 
?>
<body>
<div align="center">
  <table width="900" border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td height="40"><form id="form1" name="form1" method="post" action="add.php">
        <div align="right">
          <label>新闻序号 
		    <input type="text" name="newsid" id="newsid" size="50"/>
          新闻标题：
          <input name="topic" type="text" id="topic" size="50" />
          <BR>
          新闻内容：
          <textarea name="content" cols="60" rows="8" id="content"></textarea><BR>
          <input type="submit" name="Submit" value="添加" />
        </div>
      </form>
      </td>
    </tr>
    <tr>
      <td><hr /></td>
    </tr>
    <tr>
      <td height="300" align="center" valign="top"><table width="600" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td width="100" height="30"><div align="center">新闻序号</div></td>
          <td><div align="center">新闻标题</div></td>
          <td><div align="center">删除</div></td>
        </tr>
<?php 
      $SQLStr = "select * from news";
      $result=mysql_db_query("testDB", $SQLStr, $conn); 
      if ($row=mysql_fetch_array($result))//通过循环读取数据内容  
      { 	   
 	    // 定位到第一条记录
         mysql_data_seek($result, 0);
         // 循环取出记录
         while ($row=mysql_fetch_row($result))
         {  
?>        
 <tr>
          <td height="30"><div align="center"> <?php echo $row[0] ?> </div></td>
          <td width="400"> <div align="center"> <?php echo $row[1] ?>   </div></td>
          <td><div align="center"><a href="del.php?newsid=<?php echo $row[0] ?> " >  删除 </a> </div></td>
        </tr>
<?php 
         }
       }		
?>
      </table></td>
    </tr>
  </table>
</div>
</body>
</html>

<?php 
    // 释放资源
    mysql_free_result($result);
    // 关闭连接
    mysql_close($conn);  
?>

add.php

注意添加newsid参数接收

	 <?php 
      $conn=mysql_connect("localhost", "root", "123456");   
      mysql_select_db("testDB");  
	  $newsid=$_POST['newsid'];    
      $topic = $_POST['topic'];
      $content = $_POST['content'];
      $SQLStr = "insert into news(newsid,topic, content) values('$newsid','$topic', '$content')"; 
      echo $SQLStr; 
      $result=mysql_query($SQLStr);
       
      // 关闭连接
      mysql_close($conn);        
      if ($result)
      {
      	?>
      	<script> 
      		alert("insert succes");
      		window.location.href="sys.php";  
      	</script>
      	 <?php
      }
      else{
      	?>
      	<script> 
      		alert("insert failed");
      		history.back();  
      	</script>
      	 <?php
      }
       
?>

del.php

	 <?php 
      $conn=mysql_connect("localhost", "root", "123456");  
      mysql_select_db("testDB");       
      $newsid = $_GET['newsid']; 
      $SQLStr = "delete from news where newsid=$newsid";  
      echo $SQLStr;
      $result=mysql_query($SQLStr);       
      // 关闭连接
      mysql_close($conn);        
      if ($result)
      {
      	?>
      	<script> 
      		alert("delete succes");
      		window.location.href="sys.php";  
      	</script>
      	 <?php
      }
      else{
      	?>
      	<script> 
      		alert("delete failed");
      		history.back();  
      	</script>
      	 <?php
      }       
?>