1
林becomming在這裏很多種：普通的內部...傳遞一個MySQL排PHP/HTML表單
我試圖動態地在PHP取決於什麼結果用MYSQL語句發現打印出的表格。
請參見下面的代碼，我收到以下錯誤
[週五18年6月9日：51：32.478737 2017年] [fcgid：警告] [PID 63368] [客戶5.69.190.95:64631] mod_fcgid: stderr: PHP Parse error: syntax error, unexpected 'showhistory' (T_STRING), expecting ',' or ';' in /home/tools/public_html/searchhistory.php on line 84, referer: http://tools.cidetech.co.uk/history.php
它似乎有與環內只是「形式」建設一個問題，我沒有任何問題，直到這條線 -
echo " <td><form method="POST" action="showhistory.php">
<input type="hidden" name="id_director" value=".$row["id"]"
</form></td> ";
我似乎無法弄清楚我要去的地方錯了，這會在短短的純HTML做工精細，然而它需要在mysql/php部分內，因爲我需要通過通過按鈕內部的行ID。
具體地說是我與
for ($i = 0; $i < count($idArray); $i++)
{
$sql="SELECT * FROM history WHERE id LIKE '%{$idArray[$i]}%'";
$result=$con->query($sql);
while($row=$result->fetch_assoc())
{
echo "<tr>";
echo "<td><pre>".$row["id"]."</pre></td>";
echo "<td><pre>".$row["date"]."</pre></td>";
echo "<td><pre>".$row["domain"]."</pre></td>";
echo " <td><form method="POST" action="showhistory.php">
<input type="hidden" name="id_director" value=".$row["id"]"
</form></td> ";
}
}
echo "</table>";
mysqli_close($conn);
?>
掙扎的這部分代碼的完整代碼可以在這裏看到
<DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
<link rel="stylesheet" type="text/css" href="stylesheet.css">
<meta http-equiv="content-type" content="text/html; charset=windows-1250">
<meta name="generator" content="PSPad editor, www.pspad.com">
<title>CWCS Domain Checker Tool</title>
</head>
<body>
<div class="header">
<a href="index.php">
<img src="cwcs-logo.png">
</a>
</div>
<hr/>
<div class="searchform">
<form action="searchhistory.php" method="post">
<label for="domain"> <input class="submit" type="text" name="domain" /> </label>
<input class="submitbutton" type="submit" name="search" value="Search for Domain" />
</form>
</div>
<?php
#define connection info/variables needed
$servername = "localhost";
$username = "";
$password = "";
$dbname = "domainhistory";
$domain = $_POST['domain'];
$idArray = array();
#creates mysql connection
$con=new mysqli($servername,$username,$password,$dbname);
if($con->connect_error)
{
echo 'Connection Faild: '.$con->connect_error;
}
else
{
$sql="SELECT * FROM history WHERE domain LIKE '%{$domain}%'";
$result=$con->query($sql);
#Pushes the ID of the mysql row into an array
while($row=$result->fetch_assoc())
{
array_push($idArray,$row["id"]);
}
}
mysqli_close($conn);
?>
<!---prints out the ID's stored in the array -->
<?php
$servername = "localhost";
$username = "";
$password = "";
$dbname = "domainhistory";
$con=new mysqli($servername,$username,$password,$dbname);
if($con->connect_error)
{
echo 'Connection Faild: '.$con->connect_error;
}
else
{
}
echo "<table>";
echo "<tr>";
echo "<th> ID </th>";
echo "<th> Domain</th>";
echo "<th> Date </th>";
echo "</tr>";
## - loops through the ID array, and then prints out the data relating to that ID.
for ($i = 0; $i < count($idArray); $i++)
{
$sql="SELECT * FROM history WHERE id LIKE '%{$idArray[$i]}%'";
$result=$con->query($sql);
while($row=$result->fetch_assoc())
{
echo "<tr>";
echo "<td><pre>".$row["id"]."</pre></td>";
echo "<td><pre>".$row["date"]."</pre></td>";
echo "<td><pre>".$row["domain"]."</pre></td>";
echo " <td><form method="POST" action="showhistory.php">
<input type="hidden" name="id_director" value=".$row["id"]"
</form></td> ";
}
}
echo "</table>";
mysqli_close($conn);
?>
</body>
</html>
你的代碼容易受到[** SQL注入**]（https://en.wikipedia.org/wiki/SQL_injection ）攻擊，你應該使用[** mysqli **]（http s：//secure.php.net/manual/en/mysqli.prepare.php）或[** PDO **]（https://secure.php.net/manual/en/pdo.prepared-statements.php ）準備了具有綁定參數的語句，如[**此帖子**]（https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php）中所述。 –
在這段代碼中沒有INSERT語句嗎？我的理解是這樣的，你分享的帖子是INSERT到MYSQL表時INSERT的唯一方法嗎？ （我知道它的主題，但可以方便地進行澄清） – TheOne745665
不，SQL注入可以發生在任何語句上。注意，如果'$ domain'是''，你的查詢將會是什麼？ DROP TABLE的歷史; - ' –