摘 要

近年来，随着移动互联网的快速发展，电子商务越来越受到网民们的欢迎，电子商务对国家经济的发展也起着越来越重要的作用。简单的流程、便捷可靠的支付方式、快捷畅通的物流快递、安全的信息保护都使得电子商务越来越赢得网民们的青睐。现今，大量的计算机技术应用于商业领域，包括软件技术、网络技术、硬件技术等。越来越多的企业使用计算机来开展业务、销售、购买和宣传各种商品。各种商业系统和软件已经解放了企业的双手，并使企业能够最大限度地获得利益。因此，计算机技术在商业领域占有非常重要的地位。

本文主要通过对系统的前台系统和后台管理系统进行了功能性需求分析，对系统的安全性和可扩展性进行了非功能性需求分析。在详细的需求分析的基础上，根据系统的功能设计确定了数据库结构，实现完整的代码编写。网上二手交易平台使用 Dreamweaver、HBuilder代码编辑器、Apache服务器等开发工具，完成了系统的主要模块的页面设计和功能实现。本文展示了首页页面的实现效果图，并通过代码和页面介绍了用户注册功能、商品发表功能、充值下单功能、信息反馈功能、加入购买和查看购买功能、生成订单和查看我的订单功能、在线付款功能以及订单管理功能的实现过程。

关键词：电子商务； HBuilder代码编辑器；商品搜索

Design and implementation of online second-hand trading platform to prevent SQL injection

Abstract

In recent years, with the rapid development of mobile Internet, e-commerce is more and more welcomed by Internet users. E-commerce also plays a more and more important role in the development of national economy. Simple process, convenient and reliable payment method, fast and smooth logistics express delivery and safe information protection all make e-commerce more and more popular among Internet users. Nowadays, a large number of computer technologies are used in commercial fields, including software technology, network technology, hardware technology and so on. More and more enterprises use computers to carry out business, sell, buy and publicize all kinds of goods. Various business systems and software have liberated the hands of enterprises and enabled enterprises to maximize benefits. Therefore, computer technology plays a very important role in the commercial field.

This paper mainly analyzes the functional requirements of the foreground system and background management system, and analyzes the non functional requirements of the security and scalability of the system. Based on the detailed demand analysis, the database structure is determined according to the functional design of the system to realize the complete coding. The second-hand trading website uses Dreamweaver, hbuilder code editor, Apache server and other development tools to complete the page design and function implementation of the main modules of the system. This paper shows the implementation effect diagram of the home page, and introduces the implementation process of user registration function, commodity publishing function, recharge order function, information feedback function, add purchase and view purchase function, generate order and view my order function, online payment function and order management function through code and page.

Key words: E-commerce; Hbuilder code editor; Product search

目  录

第1章 绪论

1.1 研究背景与意义

1.2 开发现状

1.3 论文组成结构

第2章 开发工具及相关技术介绍

2.1 PHP开发语言

2.2 JavaScript脚本语言

2.3 Mysql数据库

2.4 AJAX技术

第3章 系统分析

3.1 可行性分析

3.1.1 经济可行性

3.1.2 技术可行性

3.1.3 操作可行性

3.2 功能性需求分析

3.3 非功能性需求分析

3.4 业务流程分析

第4章 系统设计

4.1 系统架构设计

4.2 功能模块设计

4.3 数据库设计

4.3.1 概念模型设计

4.3.2 数据库逻辑设计

4.3.3 数据库表设计

第5章 系统实现

5.1 用户登录的实现

5.2 系统前台主要功能实现

5.2.1 首页的实现

5.2.2 用户注册的实现

5.2.3 商品展示的实现

5.2.4 商品搜索的实现

5.2.5 商品购买的实现

5.2.6 在线留言的实现

5.3 系统后台主要功能实现

5.3.1 用户管理的实现

5.3.2 商品管理的实现

5.3.3 订单管理的实现

第6章 系统测试

6.1 系统可靠性测试

6.2 系统功能性测试

6.3 系统合格性测试

6.4 测试结果

第7章 总结与展望

参考文献

致谢

1. 绪论
   1. 研究背景与意义

1. 1. 开发现状

1. 1. 论文组成结构

1. 开发工具及相关技术介绍
   1. PHP开发语言

1. 1. JavaScript脚本语言

1. 1. Mysql数据库

1. 1. AJAX技术

1. 系统分析
   1. 可行性分析

1. 1. 1. 经济可行性

1. 1. 1. 技术可行性

1. 1. 1. 操作可行性

1. 1. 功能性需求分析

1. 1. 非功能性需求分析 

1. 1. 业务流程分析

1. 系统设计
   1. 系统架构设计

1. 1. 功能模块设计

1. 1. 数据库设计
      1. 概念模型设计

1. 1. 1. 数据库逻辑设计

1. 1. 1. 数据库表设计

1. 系统实现
   1. 用户登录的实现

public function login()

    {

        if (Request::isPost()) {

            $request = Request::param();

            $result = $this->validate($request, $this->validate);

            if (true !== $result) {

                // 验证失败 输出错误信息

                $data['error'] = 30000;

                $data['message'] = $result;

            } else {

                $request['password'] = md5($request['password']);

                $result = $this->model->login($request, $this->table);

                $data = $result;

            }

        } else {

            $data['error'] = 30000;

            $data['message'] = "field的值不能为空！";

        }

        return json_encode($data);

    }

public function login($request=[],$table_name = ''){

        $username = $request['username'];

        $password = $request['password'];

        $bol = $this->where(['username'=>$username])->find();

        if ($bol){

            $password = md5($password);

            if ($request['password']==$bol['password']) {

                //添加token信息

                $access_token['create_time'] = date('Y-m-d H:i:s');

                $access_token['update_time'] = date('Y-m-d H:i:s');

$access_token['info'] = json_encode($bol);

                // $access_token['info'] = $bol;

                $access_token['token'] = md5(date('Y-m-d H:i:s'));

                $bol_token = Db::name('AccessToken')->insert($access_token);

                if ($bol_token){

                    $data['obj'] = $bol;

                    $data['obj']['token'] = $access_token['token'];

                    return ['result' => $data];

                }else{

                    return ['error' => ['code' => 5000, 'message' => '登录失败,token生成失败']];

                }

            } else {

                return ['error' => ['code' => 5000, 'message' => '登录失败,密码不正确']];

            }

        }else{

            return ['error' => ['code' => 5000, 'message' => '登录失败,账号不存在']];

        }

    }

1. 1. 系统前台主要功能实现 
      1. 首页的实现

$obj = $this->where($where)->field($field)->find();

$result = self::allowField(true)->save($request);

$result = $this->where($where)->update($request);

$result = $this->where($where)->delete();

1. 1. 1. 用户注册的实现

用户进入系统首页后，点击“注册”链接进入到注册页面，按照页面提示输入用户名、密码和手机号，页面进行表单验证，验证输入的用户名和手机号是否合法，表单验证通过后，点击“立即注册”按钮，利用 Ajax 技术，对用户名和手机号实现页面无刷新验证，检测数据库中是否已经存在该用户名或手机号，若数据库中不存在，则注册成功，注册成功后，自动跳转到登录页面。

用户注册界面如下所示。

图5-1用户注册界面

用户注册代码如下：

public function register()

    {

        if (Request::isPost()) {

            $request = Request::param();

            $request['create_time'] = isset($request['create_time']) ? $request['create_time'] : date('Y-m-d H:i:s');

            $request['update_time'] = isset($request['update_time']) ? $request['update_time'] : date('Y-m-d H:i:s');

            $result = $this->validate($request, $this->validate);

            if (true !== $result) {

                // 验证失败 输出错误信息

                $data['error'] = 30000;

                $data['message'] = $result;

            } else {

                $request['password'] = md5($request['password']);

                $result = $this->model->register($request, $this->table);

                $data = $result;

            }

        } else {

            $data['error'] = 30000;

            $data['message'] = "field的值不能为空！";

        }

        return json_encode($data);

    }

public function register($request=[],$table_name = ''){

        $username = $request['username'];

        $bol = $this->where(['username'=>$username])->find();

        if (!$bol){

            $result = self::allowField(true)->save($request);

            if ($result) {

                return ['result' => 1];

            } else {

                return ['error' => ['code' => 3000, 'message' => '注册失败']];

            }

        }else{

            return ['error' => ['code' => 3000, 'message' => '注册失败,账号已存在']];

        }

    }

1. 1. 1. 商品展示的实现

public function get_list($request=[],$table_name = '',$table_id = ''){

        $page = 1;

        $size = $table_name == "auth" ? 100 : 10;

        $where = [];

        $order = $table_id.'_id desc';

        $field = '*';

//        echo $order;exit;

        $columns = Db::query( "show COLUMNS FROM `".$table_name."`");

        foreach($columns as $key=>$val){

            $field_name = $val['Field'];

            if(isset($request['like'])){

                if ($request['like']==true){

                    //字段模糊查询

                    if(isset($request[$field_name])){

                        $where[] = [$field_name, '=', $request[$field_name]];

                    }

                }else{

                    //字段模糊查询

                    if(isset($request[$field_name])){

                        $where[] = [$field_name, 'like', '%' . $request[$field_name] . '%'];

                    }

                }

            }else{

                //字段模糊查询

                if(isset($request[$field_name])){

                    $where[] = [$field_name, 'like', '%' . $request[$field_name] . '%'];

                }

            }

            //范围查询

            if(isset($request[$field_name.'_min'])){

                $where[] = [$field_name, '>=', $request[$field_name.'_min']];

            }

            if(isset($request[$field_name.'_max'])){

                $where[] = [$field_name, '<=', $request[$field_name.'_max']];

            }

        }

        //分页

        if (isset($request['page'])){

            $page = $request['page'];

        }

        if (isset($request['size'])){

            $size = $request['size'];

        }

        //排序

        if (isset($request['order'])){

            $order = $request['order'];

        }

        //查询字段

        if (isset($request['field'])){

            $field = $request['field'];

        }

        //模糊查询

        $list= $this->where($where)->order($order)->field($field)->page($page, $size)->select()->toArray();

        foreach($list as &$l){

         foreach($l as &$o){

         if(strpos($o,$_SERVER['HTTP_HOST']) === false){

         $o = str_replace('upload','http://'.$_SERVER['HTTP_HOST'].'/upload',$o);

         }

         }

        }

        return $list;

    }

1. 1. 1. 商品搜索的实现

系统首页提供了搜索商品的输入框，用户在输入框内输入想要查找商品的关键字，点击搜索按钮，系统将用户输入的关键字传递到后台。首先创建一个实体类 PageBean，该实体类的属性包括页码 pageCode、每页记录数 pageSize、总记录数 totalRecord 和一个 List 集合 beanList，利用输入的关键字对数据库进行模糊查询，将得到的结果存入 PageBean 中，返回PageBean 跳转到 goodList.php 页面，在 goodList.php 页面，使用循环将搜索到的结果分页展示。

商品搜索界面如下图所示。

图5-1商品搜索界面

1. 1. 1. 商品购买的实现

public function add($request=[],$table_name = '',$table_id = ''){

        $result = self::allowField(true)->save($request);

        if ($result) {

            return ['result' => 1];

        } else {

            return ['error' => ['code' => 3000, 'message' => '数据添加失败']];

        }

    }

1. 1. 1. 在线留言的实现

public function avg_group()

    {

        $request = Request::param();

        if (isset($request['groupby']) && isset($request['field'])) {

            if (!empty($request['groupby']) && !empty($request['field'])) {

                $result = $this->model->avg_group($request, $this->table, $this->table_id);

                $data = $result;

            } else {

                $data['error']['code'] = 30000;

                $data['error']['message'] = "groupby或者field的值不能为空！";

            }

        } else {

            $data['error']['code'] = 30000;

            $data['error']['message'] = "groupby或者field的值不能为空！";

        }

        return json_encode($data);

    }

1. 1. 系统后台主要功能实现 
      1. 用户管理的实现

public function change_password()

    {

        $accessTokenModel = new AccessTokenModel();

        $token = Request::header('x-auth-token');

        if (!empty($token)) {

            $result = $accessTokenModel->getToken($token);

            if (Request::isPost()) {

                $get = Request::get();

                $keys = array_keys($get);

                $where = [];

                if ($result) {

                    $where[] = ["user_id", '=', $result['user_id']];

                    $i = 0;

                    foreach ($get as $key => $val) {

                        $where[] = [$keys[$i], '=', $val];

                        $i++;

                    }

                    $request = Request::post();

                    $request['update_time'] = isset($request['update_time']) ? $request['update_time'] : date('Y-m-d H:i:s');

                    $result = $this->validate($request, $this->validate);

$new_password['password'] = $request['password'];

                    if (true !== $result) {

                        // 验证失败 输出错误信息

                        $data['error'] = 30000;

                        $data['message'] = $result;

                    } else {

                        $result = $this->model->change_password($new_password, $this->table, $this->table_id, $where);

                        $data = $result;

                    }

                } else {

                    $data['error'] = 30000;

                    $data['message'] = "token错误或失效，未查询到用户数据";

                }

            } else {

                $data['error'] = 30000;

                $data['message'] = "field的值不能为空！";

            }

        } else {

            $data['error'] = 30000;

            $data['message'] = "token的值不能为空！";

        }

        return json_encode($data);

    }

1. 1. 1. 商品管理的实现

管理员可以获取系统中所有商品的列表并对其进行编辑。管理员在添加商品时，需要输入商品基本信息，如名称、价格、规格等，还需要输入商品详情描述，包括对商品功能的描述以及展示图片等。添加商品完成，数据库商品表添加一条信息。管理员可以搜索商品，同时可以对已经添加的商品进行编辑。

商品管理界面如下图所示。

图5-1商品管理界面

商品管理主要代码如下。

public function upload()

    {

        //上传文件目录获取

        $month = date('Ym', time());

        $data = 'file';//文件域

        $path = 'upload/file/' . $month . "/";//上传文件保存位置

        $allow_ext = explode(",", "jpg,jpeg,png,jfif,bmp,gif,ico,xls,xlsx,AVI,mov,rmvb,rm,FLV,mp4,3GP");

        if ($_FILES) {

            $file = $_FILES[$data];

            $rst = [];

            if (!empty($file['name'])) {

                $file_type = explode('.', $file['name']);

                $ext = end($file_type); //获取文件的格式

                $ext = strtolower($ext);

                if (!in_array($ext, $allow_ext)) {

                    $rst['error']['code'] = 30000;

                    $rst['message'] = '只能上传jpg,jpeg,png,jfif,bmp,gif,ico,xls,xlsx,AVI,mov,rmvb,rm,FLV,mp4,3GP类型文件';

                } else {

                    if (!is_dir($path))//判断目录是否存在

                    {

                        mkdir($path, 0777, true);//如果目录不存在则创建目录

                    };

                    $name = date('YmdHis') . '_' . rand(10000, 99999) . '.' . $ext;

                    $save_rst = move_uploaded_file($file['tmp_name'], $path . $name);

                    if ($save_rst !== false) {

//                        $rst['code'] = 1;

                        $rst['result']['url'] = 'http://'.$_SERVER['HTTP_HOST'].'/'.$path . $name;

//                        $rst['ext'] = $ext;

                    } else {

                        $rst['error']['code'] = 30000;

                        $rst['error']['message'] = '文件上传失败';

                    }

                }

            } else {

                $rst['error']['code'] = 30000;

                $rst['error']['message'] = '未选择文件';

            }

        } else {

            $rst['error']['code'] = 30000;

            $rst['error']['message'] = '未获取到文件';

        }

        return json_encode($rst);

    }

1. 1. 1. 订单管理的实现

管理员在后台管理界面点击到所有订单界面dingdan_list.php，向控制层dingdanAction发送请求，搜索当前所有订单信息，dingdanAction向订单数据访问层调用搜索全部订单的请求，向数据库的订单表搜索当前所有订单并将订单信息以对象的形式层层返回到dingdan_list.php界面，显示出当前所有订单信息。同时可以删除过期订单，确认已有订单，进行发货处理。

订单管理界面如下图所示。

图5-1订单管理界面

订单管理主要代码如下。

public function sum()

    {

        $request = Request::param();

        if (isset($request['field'])) {

            if (!empty($request['field'])) {

                $result = $this->model->sum_field($request, $this->table, $this->table_id);

                $data = $result;

            } else {

                $data['error']['code'] = 30000;

                $data['error']['message'] = "field的值不能为空！";

            }

        } else {

            $data['error']['code'] = 30000;

            $data['error']['message'] = "field的值不能为空！";

        }

        return json_encode($data);

}

1. 系统测试
   1. 系统可靠性测试

1. 1. 系统功能性测试

1. 1. 系统合格性测试

1. 1. 测试结果

1. 总结与展望

参考文献