CSV文件上传与数据验证


CSV file upload with data validation

我试图使用PhP上传一个*. csv文件到数据库。我无法让数据验证与文件上传一起工作。脚本应该通过在db的表中搜索来查看来自某些单元格的数据是否有效。如果有错误,文件不应该上传!

这是代码!

<form name="import" method="post" enctype="multipart/form-data">
    <input type="file" name="file" /><br />
    <input type="submit" name="submit" value="Submit" />
</form>
<?php
    include ("connection2.php");
    if(isset($_POST["submit"]))
    {
        $file = $_FILES['file']['tmp_name'];
        $handle = fopen($file, "r");
        $c = 0;
        $err = 0;
        if ($_FILES["file"]["type"]=='application/vnd.ms-excel')
        {
            while(($filesop = fgetcsv($handle, 3000, ",")) !== false)
            {
                $tid = trim($filesop[0]);
                $beneficiar = ucwords(strtolower(trim($filesop[1])));   
                $locatie = ucwords(strtolower(trim($filesop[2])));
                $localitate = ucwords(strtolower(trim($filesop[3])));
                $judet = ucwords(strtolower(trim($filesop[4])));
                $adresa = ucwords(strtolower(trim($filesop[5])));
                $model = trim($filesop[6]);
                $query = mysqli_query("SELECT * FROM modele WHERE `model` = '".$model."'");
                if (!empty($query)) {
                    $err ++;
                    $msg=$msg."Model error on row $c <br>";
                }
                $query = mysqli_query("SELECT * FROM judete WHERE `nume` = '".$judet."'");
                if (!empty($query)) {
                    $err ++;
                    $msg=$msg."Judet error on row $c <br>";
                }
                $query = mysqli_query("SELECT * FROM beneficiari WHERE `nume` = '".$beneficiar."'");
                if (!empty($query)) {
                    $err ++;
                    $msg=$msg." Beneficiar error on row $c <br>";
                }
                // if (strlen($tid)!==8){
                    // $err ++;
                    // $msg=$msg."TID length error at row $c <br>";
                // }
                $c ++;
            }
            if ($err!==0){
                echo $msg;  echo "ERROR COUNT= ".$err;
                break;
            }
            $c=0;
            while(($filesop = fgetcsv($handle, 3000, ",")) !== false)
            { 
                $tid = trim($filesop[0]);
                $beneficiar = ucwords(strtolower(trim($filesop[1])));   
                $locatie = ucwords(strtolower(trim($filesop[2])));
                $localitate = ucwords(strtolower(trim($filesop[3])));
                $judet = ucwords(strtolower(trim($filesop[4])));
                $adresa = ucwords(strtolower(trim($filesop[5])));
                $model = trim($filesop[6]);
                $qry=mysql_query("SELECT id FROM beneficiari WHERE `nume` = '".$beneficiar."'");
                while ($row = mysql_fetch_assoc($qry)){
                    $id_client=$row['id'];
                    echo "Beneficiar=".$row['id'];
                }
                $qry_id_model=mysql_query("SELECT id FROM modele WHERE `model` = '".$model."'");
                while ($row = mysql_fetch_assoc($qry_id_model)){
                    $id_model=$row['id'];
                    echo "Model=".$row['id'];
                }
                echo "MODEL2:".$id_model;
                $adresa1 = $adresa.", ".$localitate;
                if ($c!==0){
                    $sql = mysql_query("INSERT INTO equipments 
                            (id_client, model, tid, beneficiar, adresa, agentie, judet) 
                            VALUES
                        ('$id_client','$id_model','$tid','$beneficiar','$adresa1','$locatie','$judet')");
                }
                $c = $c + 1; 
            }
            if($sql){
                echo "You database has imported successfully. You have inserted ". $c ." recordes <br>";
            }else{
                echo "Sorry! There is some problem.<br>";
            }
            echo "Upload: " . $_FILES["file"]["name"] . "<br />";
            echo "Type: " . $_FILES["file"]["type"] . "<br />";
            echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
            echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
        }
        else echo "NOT CSV!";
    }
?>

怎么了?

当我尝试运行它时,数据没有上传,没有显示错误,我在文件中留下错误来测试它。我也上传了一个干净的文件,文件也没有上传。如果我打破2个代码,使2个单独的代码,一个验证和一个上传,上传工作,但我需要验证和上传是在同一代码。

mysqli_query的过程式风格有两个参数—连接和查询。你只是在传递查询。

您可以在这里阅读mysqli_query()方法的官方文档:

http://php.net/manual/en/mysqli.query.php


关于如何处理这个问题的建议是这样的:

$link = mysqli_connect("127.0.0.1", "my_user", "my_password", "my_db");
if(!$link)
{
    echo("Unable to connect");
} else {
    if($ret = mysqli_query($link, "SELECT id FROM modele WHERE `model` = '".mysqli_real_escape_string($link, $model)."'"))
    {
        $data = mysqli_fetch_assoc($ret);
        echo($data["id"]);
    }
    mysqli_close($link);
}

重要:注意我在上面的例子中使用了mysqli_real_escape_string -您当前的代码使您容易受到SQL注入攻击。

首先你应该把这个文件上传到一个临时文件夹,并保存文件名。然后使用getCSV php函数正确读取文件。

最后,您可以检查是否一切正常,插入数据库,如果不是,回一个错误消息并删除文件(记住,我们保存了名称,我们知道临时文件夹的静态路由)。

希望有帮助!