php和javascript变量传递和安全性

<?PHP
//定义全局变量
$dbhost=“本地主机”;
$dbusername=“根”;
$dbpassword=“”;
$dbdatabase=“测试”;
$conn=new mysqli($dbhost,$dbusername,$dbpassword,$dbdatabase);
?gt;
<a href=“user43notifs.php”>单击此处转到用户43的通知</a><br><br>

&!--示例请求-->

<form action=“request.inc.php”method=“post”>
操作ID:43<br>
检阅人编号:42<br>
论文编号:34<br>
<input type=“hidden”name=“op_id”value=“43”>
<input type=“hidden”name=“reviewer_id”value=“42”>
<input type=“hidden”name=“论文ID”value=“34”>
<input type=“submit”name=“submit”>
</Form>
<form action=“request.inc.php”method=“post”>
操作ID:43<br>
检阅人编号:16<br>
论文编号:135<br>
<input type=“hidden”name=“op_id”value=“43”>
<input type=“hidden”name=“reviewer_id”value=“16”>
<input type=“hidden”name=“论文ID”value=“135”>
<input type=“submit”name=“submit”>
</Form>
<form action=“request.inc.php”method=“post”>
操作ID:78<br>
检阅人编号:12<br>
论文编号:25<br>
<input type=“hidden”name=“op_id”value=“78”>
<input type=“hidden”name=“reviewer_id”value=“12”>
<input type=“hidden”name=“论文ID”value=“25”>
<input type=“submit”name=“submit”>
</Form>
request.inc.php


<?PHP
//定义全局变量
$dbhost=“本地主机”;
$dbusername=“根”;
$dbpassword=“”;
$dbdatabase=“测试”;
$conn=new mysqli($dbhost,$dbusername,$dbpassword,$dbdatabase);

$op=mysqli_real_escape_string($conn,$_post['op_id']);
$reviewer=mysqli_real_escape_string($conn,$_post['reviewer_id']);
$SUPPITE=mysqli_real_escape_string($conn,$_post['SUPPITE_id']);

$sql=“insert into`reviewer_relationships`(`reviewer_id`,`speake_id`,`status`)
值(“$reviewer”,“$speedge”,0)”;

$result=mysqli_查询($conn,$sql);
如果($result==true){
$title=mysqli_real_escape_string($conn,$reviewer.“已请求审阅您的论文:论文.”..
$message=mysqli_real_escape_string($conn,<button onclick=“location.href=\'scripts/review_request.php?confirmation=accept\'“class=”review accept“>accept</button><button onclick=”location.href=\'scripts/review\u request.php?confirmation=decline\'“class=”review decline“>拒绝</button>');
$sql=“insert into`notifications`(`user_id`,`title`,`message`)
值(“$op”、“$title”、“$message”);

$result=mysqli_查询($conn,$sql);

如果($result==true){
echo“通知和关系插入成功”;
}
否则{
echo'通知插入失败:'.mysqli_错误($conn);
}
}
否则{
echo'关系插入失败:'.mysqli_错误($conn);
}
?gt;
user43notifs.php


<?PHP
$dbhost=“本地主机”;
$dbusername=“根”;
$dbpassword=“”;
$dbdatabase=“测试”;
$conn=new mysqli($dbhost,$dbusername,$dbpassword,$dbdatabase);

$SQL=“选择*
来自通知
其中用户“id=43”;
$result=mysqli_查询($conn,$sql);
而($row=mysqli_fetch_assoc($result))。{
echo'***********************************************lt;br>';
echo$row['title']。<br>';
echo$row['message']。<br>';
}
?gt;
使用phpmyadmin设置的这两个表:

审核人关系
<

通知


我需要一种更新审阅者关系的状态列的方法,当用户单击所述通知的接受或拒绝按钮时,该状态列由通知表示。

问题是我无法找到一种方法将关系ID(或描述关系的审阅者ID和文章ID)与它的通知关联起来,而不直接将其放入通知的HTML中,在HTML中它容易被更改。


我不经常问问题,所以任何关于问题标题、写作或陈述方式的评论都会受到极大的赞赏。如果需要其他信息,请咨询。谢谢!


下面是我的表结构(mysql):



我遇到的问题是,一旦用户接受或拒绝一个评审请求,我就不知道如何安全地更新关系表中的状态。我可以将接受/拒绝按钮的值设置为关系的ID,并使用Ajax更新该关系的状态,但这似乎不安全,因为用户可以使用inspect元素更改该值。

以下是我的一个例子:

请求.php

<?php
//define global variables
$dbhost = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbdatabase = "test";
$conn = new mysqli($dbhost, $dbusername, $dbpassword, $dbdatabase);
?>
<a href="user43notifs.php">Click here to go to user 43's notifications</a><br><br>

<!--Example requests-->

<form action="request.inc.php" method="post">
  op_id: 43<br>
  reviewer_id: 42<br>
  essay_id: 34<br>
  <input type="hidden" name="op_id" value="43">
  <input type="hidden" name="reviewer_id" value="42">
  <input type="hidden" name="essay_id" value="34">
  <input type="submit" name="submit">
</form>
<form action="request.inc.php" method="post">
  op_id: 43<br>
  reviewer_id: 16<br>
  essay_id: 135<br>
  <input type="hidden" name="op_id" value="43">
  <input type="hidden" name="reviewer_id" value="16">
  <input type="hidden" name="essay_id" value="135">
  <input type="submit" name="submit">
</form>
<form action="request.inc.php" method="post">
  op_id: 78<br>
  reviewer_id: 12<br>
  essay_id: 25<br>
  <input type="hidden" name="op_id" value="78">
  <input type="hidden" name="reviewer_id" value="12">
  <input type="hidden" name="essay_id" value="25">
  <input type="submit" name="submit">
</form>


请求.inc.php

<?php
//define global variables
$dbhost = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbdatabase = "test";
$conn = new mysqli($dbhost, $dbusername, $dbpassword, $dbdatabase);

$op = mysqli_real_escape_string($conn, $_POST['op_id']);
$reviewer = mysqli_real_escape_string($conn, $_POST['reviewer_id']);
$essay = mysqli_real_escape_string($conn, $_POST['essay_id']);

$sql = "INSERT INTO `reviewer_relations` (`reviewer_id`, `essay_id`, `status`)
VALUES ('$reviewer', '$essay', 0)";

$result=mysqli_query($conn, $sql);
if($result === TRUE){
  $title = mysqli_real_escape_string($conn, $reviewer." has requested to review your essay: essay#".$essay.".");
  $message = mysqli_real_escape_string($conn, '<button onclick="location.href=\'scripts/review_request.php?confirmation=accept\'" class="review-accept">Accept</button><button onclick="location.href=\'scripts/review_request.php?confirmation=decline\'" class="review-decline">Decline</button>');
  $sql = "INSERT INTO `notifications` (`user_id`, `title`, `message`)
  VALUES ('$op', '$title', '$message')";

  $result=mysqli_query($conn, $sql);

  if($result === TRUE){
    echo 'notification and relation insert success';
  }
  else{
    echo 'notification insert fail: '.mysqli_error($conn);
  }
}
else{
  echo 'relation insert fail: '.mysqli_error($conn);
}
?>


用户43notifs.php

<?php
$dbhost = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbdatabase = "test";
$conn = new mysqli($dbhost, $dbusername, $dbpassword, $dbdatabase);

$sql="SELECT *
FROM notifications
WHERE user_id = 43";
$result = mysqli_query($conn, $sql);
while($row = mysqli_fetch_assoc($result)){
  echo '**********************************************<br>';
  echo $row['title'].'<br>';
  echo $row['message'].'<br>';
}
?>


使用phpmyadmin设置的这两个表:

审稿人关系



通知



我需要一个保护当用户单击所述通知的接受或拒绝按钮时,更新由通知表示的审阅者关系的状态列的方法。

问题是,我无法找到一种方法将关系ID(或描述关系的审阅者ID和论文ID)与它的通知关联起来,而不直接将其放入通知的HTML中,在那里很容易被更改。

我不经常问问题,所以任何关于问题标题、写作或陈述方式的评论都会受到极大的赞赏。如果需要其他信息,请咨询。谢谢!