Php 在mysql中自动插入多次

在mysql数据库中插入一些值时，我面临一个非常奇怪的问题。以下是我插入客户信息的代码：

$customer = 0;
//session_start();
include('header.php');
include 'menu.php';
//print_r($_REQUEST);
$_SESSION['customer'] = array();
$phone_alt = 0;
$_SESSION['customer']['f_name'] = $f_name = $_REQUEST['f_name'];
$_SESSION['customer']['m_name'] = $m_name = $_REQUEST['m_name'];
$_SESSION['customer']['l_name'] = $l_name = $_REQUEST['l_name'];
$date = strtotime(date('d-m-Y H:i:s'));
$_SESSION['customer']['phone'] = $phone = $_REQUEST['phone'];

if ($_REQUEST['phone1'] == "") {
$phone_alt = 0;
}else{
$_SESSION['customer']['phone_alt'] = $phone_alt;
}
$_SESSION['customer']['street_no'] = $street_no = $_REQUEST['street_no'];
$_SESSION['customer']['street_name'] = $street_name =     $_REQUEST['street_name'];
$_SESSION['customer']['zipcode'] = $zipcode = $_REQUEST['zipcode'];
$_SESSION['customer']['city'] = $city = $_REQUEST['city'];
$_SESSION['customer']['state'] = $state = $_REQUEST['state'];
$country = $_REQUEST['country'];
$_SESSION['customer']['email'] = $email = $_REQUEST['email'];
//$email_alt = $_REQUEST['email_alt'];
$_SESSION['customer']['email_alt'] = $email_alt = $_REQUEST['email1'];
$_SESSION['customer']['agent_1'] = $agent_1 = $_REQUEST['agent_1'];
$_SESSION['customer']['agent_2'] = $agent_2 = $_REQUEST['agent_2'];
$plan = $_REQUEST['plan'];
$plan_name = $_REQUEST['plan_name'];
$plan_amount = $_REQUEST['plan_amount'];
$_SESSION['customer']['remote_id'] = $remote_id = $_REQUEST['remote_id'];
$_SESSION['customer']['remote_id1'] = $remote_id1 =     $_REQUEST['remote_id1'];
$_SESSION['customer']['status'] = $status = $_REQUEST['status'];
$remarks = mysql_real_escape_string($_REQUEST['remarks']);
$remarks = "New Customer Created<br/>" . $remarks;
//$image = $_REQUEST['image'];
$modify_time = strtotime(date('d-m-Y H:i:s'));
//print_r($_SESSION['customer']);
?>
<div class="center">
<?php
if ($f_name == "") {
echo '<h3>Enter Customer First Name</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($l_name == "") {
echo '<h3>Enter Customer Last Name</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($phone == "") {
echo '<h3>Enter Customer Phone Number.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($street_name == "") {
echo '<h3>Enter Customer Street Name.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($state == "") {
echo '<h3>Enter Customer State Name.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($email == "") {
echo '<h3>Enter Customer Mail ID.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
}elseif (!filter_var($email,FILTER_VALIDATE_EMAIL)) {
echo '<h3>Enter Correct Email Address.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
}elseif (!filter_var($email_alt,FILTER_VALIDATE_EMAIL) && $email_alt != "") {
echo '<h3>Enter Correct Alternative Email Address.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
}elseif ($country == "") {
echo '<h3>Enter Customer Country Name.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} elseif ($agent_1 == "") {
echo '<h3>Enter a Agent Name.</h3>';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/create_customer.php">BACK</a>
<?php
} else {
$sql1 = "INSERT INTO `customer`(`f_name`, `m_name`, `l_name`, `create_time`, `phone`, `alt_phone`, `street_no`, `street_name`, `zipcode`, `city`, `state`, `country`, `email`, `alt_email`, `modify_time`, `emp_id`, `agent_1`, `agent_2`, `plan`, `plan_name`, `amount`, `remote_id`, `status`, `remote_id1`)"
. " VALUES ('" . $f_name . "','" . $m_name . "','" . $l_name . "'," . $date . ",'" . $phone . "','" . $phone_alt . "','" . $street_no . "','" . $street_name . "'," . $zipcode . ",'" . $city . "','" . $state . "','" . $country . "','" . $email . "','" . $email_alt . "'," . $modify_time . "," . $_SESSION['login']['login_id'] . ",'" . $agent_1 . "','" . $agent_2 . "','" . $plan . "','" . $plan_name . "'," . $plan_amount . ",'" . $remote_id . "','" . $status . "','" . $remote_id1 . "')";
//echo $sql;
$i++;
$result = mysql_query($sql1);
//$agent_1 = "'";
$id = mysql_insert_id();
$_SESSION['login']['customer_id'] = $id;
$sql = "INSERT INTO `remarks`(`customer_id`, `status`,`remarks`, `date`) VALUES (" . $id . ",'" . $status . "','" . $remarks . "'," . strtotime(date('d-m-Y H:i:s')) . ")";
mysql_query($sql);
echo "Customer Data Successfully Inserted Into Database.";
$_SESSION['customer'] = array();
//echo '<META HTTP-EQUIV="Refresh" Content="0; URL=http://192.168.1.251/crm_demo/emp/home.php">';
?>
<a class="btn btn-success" href="http://192.168.1.251/crm_demo/emp/home.php">Home</a>
<?php
}
?>
</div>
<?php
  include 'footer.php';
?>

$customer=0；
//会话_start（）；
包括（'header.php'）；
包括“menu.php”；
//打印请求（$）；
$\u会话['customer']=array（）；
$phone_alt=0；
$\u会话['customer']['f\u name']=$f\u name=$\u请求['f\u name']；
$\u会话['customer']['m\u name']=$m\u name=$\u请求['m\u name']；
$\u会话['customer']['l\u name']=$l\u name=$\u请求['l\u name']；
$date=strottime（日期（'d-m-Y H:i:s'）；
$\会话['customer']['phone']=$phone=$\请求['phone']；
如果（$_请求['phone1']==“”）{
$phone_alt=0；
}否则{
$\u会话['customer']['phone\u alt']=$phone\u alt；
}
$\u会话['customer']['street\u no']=$street\u no=$\u请求['street\u no']；
$\会话['customer']['street\u name']=$street\u name=$\请求['street\u name']；
$\会话['customer']['zipcode']=$zipcode=$\请求['zipcode']；
$\会话['customer']['city']=$city=$\请求['city']；
$\会话['customer']['state']=$state=$\请求['state']；
$country=$_请求['country']；
$\会话['customer']['email']=$email=$\请求['email']；
//$email\u alt=$\u请求['email\u alt']；
$\会话['customer']['email\u alt']=$email\u alt=$\请求['email1']；
$\会话['customer']['agent\u 1']=$agent\u 1=$\请求['agent\u 1']；
$\会话['customer']['agent_2']=$agent_2=$\请求['agent_2']；
$plan=$_请求['plan']；
$plan\u name=$\u请求['plan\u name']；
$plan\u amount=$\u请求['plan\u amount']；
$\u会话['customer']['remote\u id']=$remote\u id=$\u请求['remote\u id']；
$\u会话['customer']['remote\u id1']=$remote\u id1=$\u请求['remote\u id1']；
$\会话['customer']['status']=$status=$\请求['status']；
$comments=mysql_real_escape_字符串（$_REQUEST['comments']）；
$备注=“新客户已创建
”$评论；
//$image=$_请求['image']；
$modify_time=STROTIME（日期（'d-m-Y H:i:s'）；
//打印（$_会话['customer']）；
?>
请了解控制结构语法备选方案：可爱的漏洞。享受你的服务器pwn3d。在这段代码中sql注入攻击是如何可能的。如果你注释
session\u start（）
out，你的会话将无法工作。我将这段代码写在header.php文件中，这就是我在这里注释这一行的原因