-1

登録フォームの検証PHPを更新しているときに、修正できないと思われるエラーが発生しました。

列数が行1の値数と一致しません

私は何度も何度もコードを調べましたが、何も問題がないようです。PHPの構文とフォーマットのチェッカーはすべて、コードに問題がないと言っているようです。このエラーが頻繁に発生することは理解していますが、自分のコードと同じエラーを受け取った他の人のコードとの類似性はわかりません。

<?
include "./includes/config.inc.php";

include $include_path."cc.inc.php";
include $include_path."banemails.inc.php";




$is_pre_registration = (isset($_REQUEST['pre_registration']) && $_REQUEST['pre_registration'] == "1") ? "1" : "";

$TIME = mktime(date("H")+$SETTINGS['timecorrection'],date("i"),date("s"),date("m"), date("d"),date("Y"));
$NOW = date("YmdHis",$TIME);
$NOWB = date("YmdHis",$TIME);
// --
if (!isset($_POST['auction_id']) && !isset($_GET['auction_id'])) {
    $auction_id = $_SESSION["CURRENT_ITEM"];
} else {
    $_SESSION["CURRENT_ITEM"]=intval($auction_id);
}
if (empty($_POST['action'])) {
    $action = "first";
}
#// Retrieve users signup settings
$query = "SELECT * FROM BPLA_usersettings";
$res_s = @mysql_query($query);
if(!$res_s){
    MySQLError($query);
    exit;
}else{
    $REQUESTED_FIELDS = unserialize(mysql_result($res_s,0,"requested_fields"));
    $MANDATORY_FIELDS = unserialize(mysql_result($res_s,0,"mandatory_fields"));
}



if ($_POST['action'] == "first") {

    if (empty($_POST['accounttype']) && $SETTINGS['accounttype'] == 'sellerbuyer') {
        $TPL_err = 1;
        $TPL_errmsg = $MSG_25_0137;
    } elseif (empty($_POST['TPL_nick'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5030;
    } elseif (empty($_POST['TPL_password'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5031;
    } elseif (empty($_POST['TPL_repeat_password'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5032;
    } elseif (empty($_POST['TPL_email'])) {
        $TPL_err = 1;
        $TPL_errmsg = $ERR_5033;
    } else {
        if (strlen($_POST['TPL_nick']) < 6) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_107;
        } else if (strlen ($_POST['TPL_password']) < 6) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_108;
        } else if ($_POST['TPL_password'] != $_POST['TPL_repeat_password']) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_109;
        } else if (strlen($_POST['TPL_email']) < 5) { // Primitive mail check
        $TPL_err = 1;
        $TPL_errmsg = $ERR_110;
        } elseif (!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+([\.][a-z0-9-]+)+$", $_POST['TPL_email'])) {
            $TPL_err = 1;
            $TPL_errmsg = $ERR_008;
        } elseif(BannedEmail($_POST['TPL_email'],$BANNEDDOMAINS)){
            $TPL_err = 1;
            $TPL_errmsg = $MSG_30_0054;
        } else {
            $sql = "SELECT nick FROM BPLA_users WHERE nick=\"" . AddSlashes ($_POST['TPL_nick']) . "\"";
            $res = mysql_query ($sql);
            if (mysql_num_rows($res) == 0) {
                $id = md5(uniqid(rand()));
                $id = eregi_replace("[a-f]", "", $id);

                $TPL_id_hidden = $id;
                $TPL_nick_hidden = $_POST['TPL_nick'];
                $TPL_password_hidden = $_POST['TPL_password'];
                $TPL_email_hidden = $_POST['TPL_email'];
            } else {
                $TPL_err = 1;
                $TPL_errmsg = $ERR_111; // Selected user already exists
            }

            $sql = "SELECT email FROM BPLA_users WHERE email=\"" . AddSlashes ($_POST['TPL_email']) . "\"";
            $res = mysql_query ($sql);
            if (mysql_num_rows($res) == 0) {
                $id = md5(uniqid(rand()));
                // $id = eregi_replace("[a-f]","",$id);
                $TPL_id_hidden = $id;
                $TPL_nick_hidden = $_POST['TPL_nick'];
                $TPL_password_hidden = $_POST['TPL_password'];
                $TPL_email_hidden = $_POST['TPL_email'];
            } else {
                $TPL_err = 1;
                $TPL_errmsg = $ERR_115; // E-mail already used
            }

            if ($TPL_err == 0) {
                $TODAY = $NOWB;
                # // #################################################################
                # // Users suspended field
                # // VALUES:
                # //        9 - sign up fee due
                # //         8 - no fee due, waiting for user's confirmation
                # //            1 - suspended by the administrator via admin utility
                # //
                $SUSPENDED = 8;
                if($SETTINGS['accounttype'] == 'sellerbuyer') {
                    $selected_accounttype = $_POST['accounttype'];
                } else {
                    $selected_accounttype = 'unique';
                }

                if($is_pre_registration != ""){
                    $user_pre_registration = "1";
                }else{
                    $user_pre_registration = "0";
                    //, is_pre_registration
                    //, ".intval($user_pre_registration)."
                }
                if($BPLowbidAuction_TESTMODE == 'yes') {
                     include "header.php";
                    echo "<strong>".$ERR_9999."</strong>";
                        include phpa_include("template_register.html");
                    exit();
                } else {
                $sql = "INSERT INTO BPLA_users (id,
                        nick, password, nletter,email, reg_date,
                        rate_sum,  rate_num,suspended,accounttype)
                          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
                      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                        . (int)($_POST['TPL_nletter']) . "\", \""
                        . AddSlashes ($_POST['TPL_email']) . "\",
                      '$TODAY',
                      0,
                      0,
                      '$DATE',
                      '$SUSPENDED',
                      ENCODE(\"$MD5_PREFIX\"))";
                $res = mysql_query ($sql);
                if ($res == 0) {
                    $TPL_err = 1;
                    $TPL_errmsg = mysql_error (); //"Error updating users data";
                } else {
                    $TPL_id_hidden=mysql_insert_id();
                    # // ===========================================================
                    # // Added by Gian for IP banning
                    # // Store user IP address in the database
                    # // ===========================================================
                    $query = "INSERT INTO BPLA_usersips VALUES(
                              NULL,
                              ".intval($TPL_id_hidden).",
                              '".$_SERVER["REMOTE_ADDR"]."',
                              'first','accept')";
                    $res___ = @mysql_query($query);
                    if (!$res___) {
                        MySQLError($query);
                        exit;
                    }
                    # // ===========================================================
                    /**
                    * Update column users in table BPLA_counters
                    */
                    $query = "UPDATE BPLA_counters SET inactiveusers=inactiveusers+1";
                    $counteruser = mysql_query($query);
                    if (!$counteruser) {
                        MySQLError($query);
                        exit;
                    }
                    # // ===========================================================
                    /**
                    * Set up the language of this user in table BPLA_userslanguage
                    */
                    $language = $SETTINGS['defaultlanguage'];
                    $_SESSION['language'] = $language;
                    $userlanguage = mysql_query("INSERT INTO BPLA_userslanguage VALUES(
                                         '".$TPL_id_hidden."',
                                         '$language')");
                    if (!$userlanguage) {
                        MySQLError($query);
                        exit;
                    }
                    # // Send confirmation e-mail message depending on the peyment settings
                    #// and the signup confirmation settings
                    //if ($SETTINGS['signupfee'] != 1) {
 //                       if(($SETTINGS['usignupconfirmation'] == 'y' && $SETTINGS['accounttype'] == 'unique') || 
 //                          (($SETTINGS['sbsignupconfirmation'] == 's' || $SETTINGS['sbsignupconfirmation'] == 'sb') && $_POST['accounttype'] == 'seller') ||
 //                          (($SETTINGS['sbsignupconfirmation'] == 'b' || $SETTINGS['sbsignupconfirmation'] == 'sb') && $_POST['accounttype'] == 'buyer')) {
                            #Suspend user
                    $query = "UPDATE BPLA_users SET suspended=0,reg_date=reg_date WHERE id=$TPL_id_hidden";
                    $RES__ = @mysql_query($query);
                    if (!$RES__) {
                        echo "KLSDHD";
                        //MySQLError($query);
                        exit;
                    } else {
                        # Send e-mail to the user and the admin                    
                        include $include_path."user_confirmation_needapproval.inc.php";                        
                    }
//                        }else{
//                            include $include_path."user_confirmation.inc.php";
 //                       }
                    //}
                }
                }
            } // if($TPL_err == 0)
        }
    }
}


include "header.php";
if (($action == "first" && count($_POST) == 0) || ($_POST['action'] == "first" && $TPL_err)) {
    include phpa_include("template_register.html");
}

if ($_POST['action'] == "first" && !$TPL_err) {
    # //
    include phpa_include("template_registered_php.html");
}
include "footer.php";
$TPL_err = 0;
$TPL_errmsg = "";
?>

かわった:

       $sql = "INSERT INTO BPLA_users (id,
                nick, password, nletter,email, reg_date,
                rate_sum,  rate_num,suspended,accounttype)
                  VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
              . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                . (int)($_POST['TPL_nletter']) . "\", \""
                . AddSlashes ($_POST['TPL_email']) . "\",
              '$TODAY',
              0,
              0,
              '$DATE',
              '$SUSPENDED',
              ENCODE(\"$CC\",\"$MD5_PREFIX\"),
              '$_POST[TPL_exp_month]','$_POST[TPL_exp_year]','$_POST[TPL_card_owner]','$_POST[TPL_card_zip]',1)"

に:

$sql = "INSERT INTO BPLA_users (id,
                        nick, password, nletter,email, reg_date,
                        rate_sum,  rate_num,suspended,accounttype)
                          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
                      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
                        . (int)($_POST['TPL_nletter']) . "\", \""
                        . AddSlashes ($_POST['TPL_email']) . "\",
                      '$TODAY',
                      0,
                      0,
                      '$DATE',
                      '$SUSPENDED',
                      ENCODE(\"$MD5_PREFIX\"))";

エラーが発生しました:SQL構文にエラーがあります。10行目の「))」の近くで使用する正しい構文については、MySQLサーバーのバージョンに対応するマニュアルを確認してください。

4

2 に答える 2

1

このエラーは、INSERTクエリで指定された列の数が、提供された値の数と一致しない場合に発生します。例えば:

INSERT INTO mytable (col1, col2) VALUES ('val1');

次の行では、10 個の列 (id、nick、password、nletter、email、reg_date、rate_sum、rate_num、suspended、accounttype) をリストしますが、値は 16 個です。

$sql = "INSERT INTO BPLA_users (id,
        nick, password, nletter,email, reg_date,
        rate_sum,  rate_num,suspended,accounttype)
          VALUES (NULL, \"" . Addslashes ($TPL_nick_hidden) . "\", \""
      . md5($MD5_PREFIX . Addslashes ($TPL_password_hidden)) . "\", \""
        . (int)($_POST['TPL_nletter']) . "\", \""
        . AddSlashes ($_POST['TPL_email']) . "\",
      '$TODAY',
      0,
      0,
      '$DATE',
      '$SUSPENDED',
      ENCODE(\"$CC\",\"$MD5_PREFIX\"),
      '$_POST[TPL_exp_month]','$_POST[TPL_exp_year]','$_POST[TPL_card_owner]','$_POST[TPL_card_zip]',1)";

次の値に対応する列名をリストする必要があります。

$_POST[TPL_exp_month]
$_POST[TPL_exp_year]
$_POST[TPL_card_owner]
$_POST[TPL_card_zip]
1

非常に重要: SQL インジェクションを防ぐために、準備済みステートメントを使用する必要があります。これは非常に危険で、悲しいことに非常に一般的な攻撃です。https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheetを参照してください

于 2012-11-18T18:09:32.313 に答える
1

クエリINSERT INTO BPLA_users ...;には 10 個の列名がありますが、16 個の値があります。数字が一致しないため、エラーが発生します。

于 2012-11-18T18:11:59.553 に答える