我如何在PHP页面之间共享数据？

Question

我有一个PHP页面,我想在UserID,密码等页面之间共享一些数据.

我正在学习会话,我不确定我是否正确使用它.

<?php
require_once('database.inc');
$kUserID = $_POST['kUserID'];
$kPassword = $_POST['kPassword'];

if (!isset($kUserID) || !isset($kPassword)) { 
    header( "Location: http://domain/index.html" ); 
}

elseif (empty($kUserID) || empty($kPassword)) { 
    header( "Location: http://domain/index.html" ); 
} 
else { 
    $user = addslashes($_POST['kUserID']); 
    $pass = md5($_POST['kPassword']); 
    $db = mysql_connect("$sHostname:$sPort", $sUsername, $sPassword) or die(mysql_error()); 
    mysql_select_db($sDatabase) or die ("Couldn't select the database."); 
    $sqlQuery = "select * from allowedUsers where UserID='" . $kUserID . "' AND passwordID='" . $kPassword . "'";
    $result=mysql_query($sqlQuery, $db);
    $rowCheck = mysql_num_rows($result); 
    if($rowCheck > 0){ 
        while($row = mysql_fetch_array($result)){
            session_start();
            session_register('kUserID'); 
            header( "Location: link.php" );
       } 
    } 
    else { 
        echo 'Incorrect login name or password. Please try again.'; 
    } 
} 
?> 

Answer 1

对于所有神圣的爱,不要使用addslashes来防止SQL注入.

我刚拥有你的网站:

你的网站图片http://localhostr.com/files/8f996b/Screen+shot+2010-02-23+at+7.49.00+PM.png

编辑:更糟糕的是.

我刚注意到你试图通过addslashes防止注射,甚至没有被使用!

<?php
$kUserID = $_POST['kUserID'];
$user = addslashes($_POST['kUserID']); // this isn't used
$sqlQuery = "select * from allowedUsers where UserID='"
  . $kUserID . "' AND passwordID='" . $kPassword . "'";