Ili kuweza kuelewa vyema post hii tafadhali rejea mafunzo yetu ya php level 3 somo la 21 na 22 [1] utajifunza kwa urefu zaidi kuhusu sql injection na jinsi inavyofanya kazi. Kisha ndipo utajifunza jinsi ya kuzuia kwa kutumia prepared statement.
Pia ejea mafunzo haya kwa njia ya video kwenye channel yeu inayopatikana kwa jina la tehama-tz kwa link hii https://youtube.com/@tehama-tz
Hapa chini nitakuletea mafaili yaliyobadilishwa baada ya kyfanyiwa njia hii:
post.php
<html>
<head>
<title>create your post</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="https://cdn.ckeditor.com/4.16.2/standard/ckeditor.js"></script>
<script src="ckeditor.js"></script>
<link rel="stylesheet" href="style.css">
</head>
<body>
<form action="" method="post" enctype="multipart/form-data">
<label for="title">Title</label><br>
<input type="text" name="title" placeholder="write your post title" id="title"><br>
<label for="summary">Summary</label><br>
<input type="text" name="summary" placeholder="write your post summary" id="summary"><br>
<label for="content">content</label><br>
<textarea name="content" id="content" placeholder="wrte your post content"></textarea>
<script>CKEDITOR.replace( 'content' );
</script>
<label for="publisher">publisher</label><br>
<input type="text" name="publisher" placeholder="write your post publisher" id="publisher"><br>
<label for="date">Date</label><br>
<input type="date" name="date" placeholder="write your post date" id="date"><br><br>
<label for="image">upload your image</label>
<input type="file" name="file" accept="image/*" id="image"><br><br>
<input type="submit" name="submit" value="submit">
</form>
<br><br>
</body>
</html>
<?php
include "config.php";
if (isset($_POST['submit'])) {
//start code
// form variables
$title = filter_var($_POST['title'], FILTER_SANITIZE_STRING);
$summary = filter_var($_POST['summary'], FILTER_SANITIZE_STRING);
$content = $_POST['content'];
$publisher = filter_var($_POST['publisher'], FILTER_SANITIZE_STRING);
$date = filter_var($_POST['date'], FILTER_SANITIZE_STRING);
$image = filter_var($_FILES['file']['name'], FILTER_SANITIZE_STRING);
$folder = "upload/";
$location = $_FILES['file']['tmp_name'];
$size = $_FILES['file']['size']; //1024 = 1kb, 1024 kb = 1mb, 1024 = 1 gb 5*1024*1024 = 5242880
$format = ["webp", "jpg", "jpeg", "png"];
$extension = pathinfo($image, PATHINFO_EXTENSION);
if (!in_array($extension, $format)){
echo "we dont allow such file format";
}else {
if ($size > 5242880) {
echo "your file is too large";
} else {
//$sql = "INSERT INTO posts(title, summary, content, publisher, post_time, image) VALUES ('$title', '$summary', '$content', '$publisher', '$date', '$image' )";
$sql = $conn->prepare("INSERT INTO posts(title, summary, content, publisher, post_time, image) VALUES (?,?,?,?,?,? )");
$sql->bind_param("ssssss",$title, $summary, $content, $publisher, $date, $image );
if ($sql->execute()) {
move_uploaded_file($location, $folder . $image);
header("location:dashboard.php");
} else {
echo "try again";
}
}
}
}else{
echo "we dont accept empty form";
}
post_script.php
<?php
include "config.php";
if (isset($_POST['submit'])) {
//start code
// form variables
$id = filter_var($_GET['id'], FILTER_SANITIZE_NUMBER_INT);
$title = filter_var($_POST['title'], FILTER_SANITIZE_STRING);
$summary = filter_var($_POST['summary'], FILTER_SANITIZE_STRING);
$content = $_POST['content'];
$publisher = filter_var($_POST['publisher'], FILTER_SANITIZE_STRING);
$date = filter_var($_POST['date'], FILTER_SANITIZE_STRING);
$image = filter_var($_FILES['file']['name'], FILTER_SANITIZE_STRING);
$folder = "upload/";
$old_image = filter_var($_GET['old_image'], FILTER_SANITIZE_STRING);
$location = $_FILES['file']['tmp_name'];
$size = $_FILES['file']['size']; //1024 = 1kb, 1024 kb = 1mb, 1024 = 1 gb 5*1024*1024 = 5242880
$format = ["webp", "jpg", "jpeg", "png"];
$extension = pathinfo($image, PATHINFO_EXTENSION);
if (!in_array($extension, $format)){
echo "we dont allow such file format";
}else {
if ($size > 5242880) {
echo "your file is too large";
} else {
//$sql ="UPDATE posts set title = '$title', summary = '$summary', content = '$content', publisher = '$publisher', post_time = '$date', updated_time = '$update' where id = $id";
$sql = $conn->prepare("UPDATE posts set title = ?, summary = ?, content = ?, publisher =?, post_time =?, updated_time= ? where id = ?");
$sql->bind_param("ssssssi", $title, $summary, $content,$publisher,$date, $update, $id );
if ($sql->execute()) {
if ($image ==""){echo "no image";}else{
//$sql2 = "UPDATE posts set image = '$image' where id = $id";
$sql = $conn->prepare("UPDATE posts set image =? where id=?");
$sql->bind_param("si", $image,$id);
if ($sql->execute()){
if (unlink("upload/".$old_image)){
move_uploaded_file($location, $folder . $image);
}else{
echo "sorry we couldn't delete old image";
}
}
}
header("location:dashboard.php");
} else {
echo "try again";
}
}
}
}else{
echo "we dont accept empty form";
}
Mwisho
Somo linalofuata utajifunza kutumia prepared statement kwente ku select data kutoka kwenye database.
