我的id = x只顯示所有內容？

Question

我終於學會了如何做到這一點 但問題是，當我點擊lol.php ID = 2它仍然顯示的所有內容 這裏來源：

<?php 

    mysql_connect("localhost", "root", ""); 
    mysql_select_db("blog"); 

    $result = mysql_query("SELECT post_id, title, body FROM posts ORDER BY post_id DESC"); 

    while ($row = mysql_fetch_array($result)){ 
     $jokeid = $row["post_id"]; 
     $title = $row["title"]; 
     $body = $row["body"]; 
     echo("<A HREF='lol.php?view=$jokeid'>$title</A>". "<br />". $body . "<br />"); 
    } 
    mysql_close(); 
?> 

任何安全建議，我應該在哪裏在這裏應用mysql_reall_escape_string？

Answer 1

您沒有用戶輸入的任何處理程序，你可以試試下面，這將檢查id=NUMBER是否設置第一

<?php 

mysql_connect("localhost", "root", ""); 
mysql_select_db("blog"); 
if ($_GET['id']) { 
    $result = mysql_query("SELECT title, body FROM posts WHERE post_id = ".intval($_GET['id'])); 
    $post = mysql_fetch_assoc($result); 
    // use $post to show whatever you want here 
} 
else{ 
    $result = mysql_query("SELECT post_id, title, body FROM posts ORDER BY post_id DESC"); 

    while ($row = mysql_fetch_array($result)){ 
    $jokeid = $row["post_id"]; 
    $title = $row["title"]; 
    $body = $row["body"]; 
    echo("<A HREF='lol.php?view=".$jokeid."'>".$title."</A>". "<br />". $body . "<br />"); 
    } 
} 
mysql_close(); 

Answer 2

則需要使用逃脫輸出數據庫變量htmlspecialchars()

$title = htmlspecialchars($row["title"]); 
$body = htmlspecialchars($row["body"]); 
echo("<A HREF='lol.php?view=$jokeid'>$title</A>". "<br />". $body . "<br />"); 

這可以防止在用戶輸入填充數據庫時發生跨站點腳本的可能性。