无法验证本地库重复邮箱，注册遇500内部服务器错误求助

核心问题分析 #

1. 未提前检查邮箱是否已存在，重复插入同邮箱时触发数据库唯一约束冲突，直接抛出500错误
2. 代码存在SQL注入风险，看似用了prepare但实际是字符串拼接变量，没真正实现参数绑定
3. 未启用PDO错误捕获，无法明确错误原因
4. 密码确认字段password_confirm未做校验，存在逻辑漏洞

修复后的完整代码 #

<?php
include 'DbConnect.php';
$objDb = new DbConnect;
$conn = $objDb->connect();

// 开启PDO错误模式，便于排查问题
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$data = json_decode(file_get_contents('php://input'));

// 基础参数校验
if (empty($data->email) || empty($data->password) || empty($data->password_confirm)) {
    echo json_encode(['status' => 0, 'message' => '邮箱、密码及确认密码不能为空']);
    exit;
}

// 校验密码一致性
if ($data->password !== $data->password_confirm) {
    echo json_encode(['status' => 0, 'message' => '两次输入的密码不一致']);
    exit;
}

$first_name = $data->first_name;
$name = $data->name;
$email = $data->email;
$password = $data->password;

$password_hash = password_hash($password, PASSWORD_DEFAULT);

$method = $_SERVER['REQUEST_METHOD'];

switch($method){
    case "POST":
        try {
            // 先检查邮箱是否已存在
            $checkSql = "SELECT id FROM register WHERE email = :email";
            $checkStmt = $conn->prepare($checkSql);
            $checkStmt->bindParam(':email', $email);
            $checkStmt->execute();
            
            if ($checkStmt->rowCount() > 0) {
                echo json_encode(['status' => 0, 'message' => '该邮箱已被注册']);
                exit;
            }

            // 使用参数绑定插入数据，避免SQL注入
            $sql = "INSERT INTO register(name, first_name, email, password_hash) VALUES (:name, :first_name, :email, :password_hash)";
            $stmt = $conn->prepare($sql);
            $stmt->bindParam(':name', $name);
            $stmt->bindParam(':first_name', $first_name);
            $stmt->bindParam(':email', $email);
            $stmt->bindParam(':password_hash', $password_hash);

            if($stmt->execute()){
                $response = ['status' => 1, 'message' => '注册成功'];
            }else{
                $response = ['status' => 0 , 'message' => '注册失败'];
            }

            echo json_encode($response);
        } catch(PDOException $e) {
            // 捕获错误并返回，便于调试
            echo json_encode(['status' => 0, 'message' => '系统错误：' . $e->getMessage()]);
        }
        break;
}
?>

关键修复点说明 #

• 邮箱重复校验：插入前先执行查询，判断邮箱是否已存在，提前返回友好提示
• SQL注入防护：改用bindParam绑定参数，彻底避免字符串拼接带来的注入风险
• 错误捕获：开启PDO异常模式，捕获并返回具体错误信息，方便排查问题
• 密码校验：新增密码一致性检查，完善注册逻辑

内容的提问来源于stack exchange，提问作者Jordan Dohou