用於查詢表中所有記錄的字符串

當我單獨拉動每個leadstatus（？leadstatus = New，？leadstatus = Hot等）時，它們都能正常工作，但在嘗試獲取All時，似乎無法獲得它工作。您可以看到，頁面上的默認值是New leads。用於查詢表中所有記錄的字符串

`$query = "SELECT * FROM contacts WHERE contacttype IN ('New','Buyer','Seller','Buyer/Seller','Investor') AND leadstatus = 'New' ORDER BY date DESC"; 

    if(isset($_GET['leadstatus']) && in_array($_GET['leadstatus'], array('New', 'Hot', 'Warm', 'Cold', 'Rejected', 'Closed'))) 
    {  
    $status = $_GET['leadstatus']; 
    $query = "SELECT * FROM contacts WHERE leadstatus = '".$status."' ORDER BY contacts.date DESC"; 
    }`

這裏有一些我沒有運氣嘗試字符串：

?leadstatus=New&leadstatus=Hot&leadstatus=Warm&leadstatus=Rejected&leadstatus=Cold - Only pulls last listed, which is Cold 

?leadstatus[]=New&leadstatus=[]Hot&leadstatus[]=Warm&leadstatus[]=Rejected&leadstatus[]=Cold - Returns default, which is New 

?leadstatus=New&Hot&Warm&Rejected&Cold

返回默認情況下，這是新

來源

2012-06-25 Josh

爲什麼不只是使where語句有條件？如果狀態表明您想要所有記錄，請刪除where子句。 –

if(isset($_GET['leadstatus']) && $_GET['leadstatus'] == "all") { 
    $query = "SELECT * FROM contacts ORDER BY contacts.date DESC"; 
} else if (in_array($_GET['leadstatus'], array('New', 'Hot', 'Warm', 'Cold', 'Rejected', 'Closed'))) {  
    $status = $_GET['leadstatus']; 
    $query = "SELECT * FROM contacts WHERE leadstatus = '".$status."' ORDER BY contacts.date DESC"; 
}

然後，使leadstatus =所有。

來源

2012-06-25 18:05:55 JROB

試試這個：

if(isset($_GET['leadstatus']) && in_array($_GET['leadstatus'], array('New', 'Hot', 'Warm', 'Cold', 'Rejected', 'Closed'))) 
{  
    $status = $_GET['leadstatus']; 
    if(!empty($status)) { 
    $query = "SELECT * FROM contacts WHERE leadstatus = '".$status."' ORDER BY contacts.date DESC"; 
    } else { 
    $query = "SELECT * FROM contacts ORDER BY contacts.date DESC"; 
    } 
}`

不過，我也建議你使用參數化查詢？您可以在這裏查看SQL注入攻擊。

來源

2012-06-25 18:11:55 ametren

它會在登錄屏幕後面，所以不應該有問題，對不對？ – Josh

它總是很重要！注入攻擊非常容易給予攻擊者很多權力。例如，如果我輸入一個表示'？leadstatus ='的請求，該怎麼辦？ DROP TABLE聯繫人; - '相關：http://xkcd.com/327/ – ametren

好點，謝謝！ – Josh

像這樣的東西應該匹配多個條件，允許你一次混合和匹配幾個，而不是1個或全部。

$status = join(',',$_GET['leadstatus']); 
$query = "SELECT * FROM contacts WHERE leadstatus IN($status) ORDER BY contacts.date DESC";

來源

2012-06-25 18:17:37 Tank

用於查詢表中所有記錄的字符串

回答

相關問題