PHP成員搜索的問題

Question

我對PHP還是很新的，所以如果我忽略了一些簡單的東西，請原諒我。我正在嘗試構建一個會員搜索表單，通過輸入一個或多個標準來允許用戶查找成員：名字或用戶名，城市，州，國家或通過電子郵件地址。如果輸入單個字段，則表單可以工作，或者只有當名稱/用戶名字段具有值時，該表單纔有效。假設這是一個邏輯問題。提前致謝。

if (!isset($_POST['fname'])) 
{ 
//If not isset -> set with dummy value 
$_POST['fname'] = "undefine"; 
} 
if (!isset($_POST['city'])) 
{ 
//If not isset -> set with dummy value 
$_POST['city'] = "undefine"; 
} 
if (!isset($_POST['state'])) 
{ 
//If not isset -> set with dummy value 
$_POST['state'] = "undefine"; 
} 
if (!isset($_POST['country'])) 
{ 
//If not isset -> set with dummy value 
$_POST['country'] = "undefine"; 
} 
if (!isset($_POST['email'])) 
{ 
//If not isset -> set with dummy value 
$_POST['email'] = "undefine"; 
} 

// DEFAULT QUERY STRING 
$queryString = ''; 

if ($_POST['fname'] != '') { 
    $fname = $_POST['fname']; 
    $fname = stripslashes($fname); 
    $fname = strip_tags($fname); 
    $fname = preg_replace('#[^A-Za-z 0-9]#i', '', $fname); 
    $fname = mysql_real_escape_string($fname); 
    $queryString = "(firstname LIKE '%$fname%' OR username LIKE '%$fname%')"; 
} else { 
    $queryString = ''; 
} 

if ($_POST['city'] != '') { 

    if (($_POST['fname'] != '') || ($_POST['state'] != '') || ($_POST['country'] != '') || ($_POST['email'] != '')){ 
     $city = $_POST['city']; 
     $city = stripslashes($city); 
     $city = strip_tags($city); 
     $city = preg_replace('#[^A-Za-z 0-9]#i', '', $city); 
     $city = mysql_real_escape_string($city); 
     $queryString .= " AND city='$city'"; 
    } else { 
    $city = $_POST['city']; 
     $city = $_POST['city']; 
     $city = stripslashes($city); 
     $city = strip_tags($city); 
     $city = preg_replace('#[^A-Za-z 0-9]#i', '', $city); 
     $city = mysql_real_escape_string($city); 
    $queryString .= "city='$city'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

if ($_POST['state'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['country']) || ($_POST['email'])){ 
     $state = $_POST['state']; 
     $state = stripslashes($state); 
     $state = strip_tags($state); 
     $state = preg_replace('#[^A-Za-z 0-9]#i', '', $state); 
     $state = mysql_real_escape_string($state); 
     $queryString .= " AND state='$state'"; 
    } else { 
    $state = $_POST['state']; 
     $state = stripslashes($state); 
     $state = strip_tags($state); 
     $state = preg_replace('#[^A-Za-z 0-9]#i', '', $state); 
     $state = mysql_real_escape_string($state); 
    $queryString .= "state='$state'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

if ($_POST['country'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['state']) || ($_POST['email'])) { 
    $country = $_POST['country']; 
    $queryString .= " AND country='$country'"; 
    } 
    else { 
    $country = $_POST['country']; 
    $queryString .= "country='$country'"; 
    } 
} else { 
    $queryString .= ''; 
} 

if ($_POST['email'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['state']) || ($_POST['country'])){ 
     $email = $_POST['email']; 
       $email = stripslashes($email); 
     $email = strip_tags($email); 
     $email = preg_replace('#[^A-Za-z 0-9,.@-]#i', '', $email); 
     $email = mysql_real_escape_string($email); 
     $queryString .= " AND email='$email'"; 
    } else { 
    $email = $_POST['email']; 
    $queryString .= "email='$email'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

////////////// QUERY THE MEMBER DATA USING THE $queryString variable's value 
$sql = mysql_query("SELECT id, username, firstname, city, state, country FROM members WHERE $queryString AND emailactivated='1' ORDER BY id ASC"); 

Answer 1

//獲得像所有發佈的數據這

if(isset($_POST['fname'])) 
{ 
    $fname=$_POST['fname']; 
} 

//獲取所有字段值

if(empty($fname)) 
{ 
} 
else 
{ 
    $where . ="fname=$fname and "; 
} 
//Check and build where for each field 

// then remove the last and 

$where = rtrim($where, ' AND '); 

if (empty($where)) { 
     $where_str = NULL; 
     } else { 
     $where_str = "WHERE $where"; 
     } 

$query ="select fieldNames from tableName "; 

$query . =$where_str; 

Answer 2

絕對是一個非常可怕的方法來構建查詢字符串。我會說廢話並重新開始，但由於你是新人，我們只會處理你的事情。

第一步是停止假設你的SQL正在工作。您沒有任何錯誤檢查您的查詢呼叫，因此您可以通過有用的反饋獲得ZERO。因此更改查詢調用：

$sql = mysql_query(...query...) or die(mysql_error()); 
           ^^^^^^^^^^^^^^^^^^^^^^---add this 

現在，您將獲得實際的MySQL錯誤消息的一個漂亮的轉儲，與查詢的片段一起說明在何處/如何查詢的錯誤。最有可能的是，鑑於您在那裏添加的所有這些字段，您已經忘記了空間或其他內容，並使查詢看起來像p=qand z=y（請注意，q和and之間沒有空格）。

一旦您收到這些錯誤消息，您將更容易找出語法錯誤的位置以及解決該問題的方法。

Answer 3

一對夫婦的問題，我看到：

1. 在你isset測試中，您將未定義的變量'undefine'，但是當你創建你的查詢，您測試''。這意味着如果名字是空白的，你將一直在尋找名爲undefine的人。

2. 您不應該試圖用您的代碼修改$_POST變量。您需要將$_POST加載到另一個變量中，並在代碼中處理該變量。