php - 是什么会导致PHP插入MYSQL数据库，从而将其他用户的数据错误地插入行中？

我的一个学生把她的分数存到一个MySQL数据库中，但是不知怎么的，一个不同的人的名字最终被存储在她的数据库行中。这怎么可能？这是插入的PHP。

// Get Configuration file
require "configenzymatic.php";

// Connect to your server

$dbh = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8", $user, $pass, array(PDO::MYSQL_ATTR_FOUND_ROWS => true));

$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

///////////////////////////////////////////////////////
// Status Checker
///////////////////////////////////////////////////////
if ($_GET["status"]) {
    echo "online";
    exit;
}

///////////////////////////////////////////////////////
// Upload new score
///////////////////////////////////////////////////////

//set POST data as data to be checked and updated
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$password = $_POST['password'];
$level1right = $_POST['level1right'];
$level1wrong = $_POST['level1wrong'];
$level2right = $_POST['level2right'];
$level2wrong = $_POST['level2wrong'];
$level3right = $_POST['level3right'];
$level3wrong = $_POST['level3wrong'];
$level4right = $_POST['level4right'];
$level4wrong = $_POST['level4wrong'];

// check for email and set hash variable
$stm = $dbh->prepare("SELECT * FROM $tname WHERE email=?");
$stm->bindValue(1, $email, PDO::PARAM_STR);
$stm->execute();

while ($row = $stm->fetch(PDO::FETCH_ASSOC)) {
    $hashes = array($row['hash']);
    $hash = $row['hash'];
    $id = $row['id'];
    foreach ($hashes as $hash) {
        // If hash matches password, then...

        if (password_verify($password, $hash)) {
            // Everything is cool -- Insert the data into the database (update)

            $stmt = $dbh->prepare("
UPDATE $tname
   SET firstname = :firstname
     , lastname = :lastname
     ,  hash = :hash
     , level1right = :level1right
     , level1wrong = :level1wrong
     , level2right = :level2right
     , level2wrong = :level2wrong
     , level3right = :level3right
     , level3wrong = :level3wrong
     , level4right = :level4right
     , level4wrong = :level4wrong
 WHERE email = :email
   AND id = :id");
            $stmt->execute(array($firstname, $lastname, $hash, $level1right, $level1wrong, $level2right, $level2wrong, $level3right, $level3wrong, $level4right, $level4wrong, $email, $id));
            $affected_rows = $stmt->rowCount();

            // check if row inserted

            /* Return number of rows that were updated */
            $count = $stmt->rowCount();
            echo "$count";
        }
    }
}

那个学生输入了她的名字，但插入了别人的名字。我完全被这件事搞糊涂了。有人知道这是怎么发生的吗？今天12:30:44，我的学生在13:44:15添加了她的数据。这些数据是怎么混在一起的？

最佳答案

我不确定为什么你的更新被包裹在多个循环中，但是完全可以使用同一个密码散列的用户，并且（我想）会解释你看到的行为。
您大概是想用表单中提交的电子邮件和密码更新单个用户？我假设您的表上也有限制，以确保电子邮件地址是唯一的。所以，你要抓取与该电子邮件匹配的单个用户，并检查他们的密码。如果匹配，则使用相同的数据库ID更新单个记录。无循环！

// get password hash
$stm = $dbh->prepare("SELECT id, hash FROM $tname WHERE email=?");
$stm->execute([$_POST["email"]]);

$row  = $stm->fetch(PDO::FETCH_ASSOC);
$hash = $row['hash'];
$id   = $row['id'];
if (!password_verify($_POST["password"], $hash)) {
    // verification failed, do something to present an error to the user
    die();
}
$stmt = $dbh->prepare(
    "UPDATE $tname
        SET firstname=:firstname, lastname=:lastname,
            level1right=:level1right, level1wrong=:level1wrong,
            level2right=:level2right, level2wrong=:level2wrong,
            level3right=:level3right, level3wrong=:level3wrong,
            level4right=:level4right, level4wrong=:level4wrong
        WHERE id=:id"
);
$stmt->execute([
    ":firstname"   => $_POST["firstname"],
    ":lastname"    => $_POST["lastname"],
    ":level1right" => $_POST["level1right"],
    ":level1wrong" => $_POST["level1wrong"],
    ":level2right" => $_POST["level2right"],
    ":level2wrong" => $_POST["level2wrong"],
    ":level3right" => $_POST["level3right"],
    ":level3wrong" => $_POST["level3wrong"],
    ":level4right" => $_POST["level4right"],
    ":level4wrong" => $_POST["level4wrong"],
    ":id"          => $id
]);
$count = $stmt->rowCount();
echo "$count";

还要注意，在PDO中使用命名参数需要使用关联数组。不知道如果没有它，你的原始代码将如何更新任何东西。

关于php - 是什么会导致PHP插入MYSQL数据库，从而将其他用户的数据错误地插入行中？，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/58828373/