過濾系統不工作

Question

你好，我讓我的過濾系統是一個簡單的只有位置和價格範圍現在設置一切看起來像這樣： 所以我的問題是最小和最大價格範圍過濾器不工作位置過濾器正在工作，因爲它應該是我面臨的唯一問題是最小和最大價格沒有任何錯誤或警告，但食客沒有任何反應。

PHP上面的代碼：

$cat1 = ''; 

if(isset($_GET["catid"])){ 

    $p1 = ''; 
    $p2 = ''; 
    $catid = $_GET["catid"]; 
    $l1 = substr($catid,0,1); 
    $l2 = substr($catid,1,1); 
    $p1 = "CAT".$l1; 
    if(!empty($l2)){ 
     $p2 = "CAT".$l1."-".$l2; 
     $p3 = $p2; 
    } 
    $cat1 = @$lang[$p1]; 
    $cat2 = @$lang[$p2]; 
} 

$postid = ''; 
$userid = ''; 
$pricemin = ''; 
$pricemax = ''; 
$location = ''; 

if(isset($_POST["filter"])){ 

$pricemin = $_POST["min"]; 
$pricemax = $_POST["max"]; 
$location = $_POST["location"]; 
} 

主要頁面代碼：

<div class="fp"> 
     <div class="filter"> 
      <b style="padding-left: 10px;">Filters:</b> 
      <form class="filterform" action="" method="post"><br> 
       Location: <br> 
       <input name="location" ><br> 
       Price Range:<br> 
       Min:<input type="text" name="min" size="5"> Max:<input type="text" name="max" size="5"><br><br> 
       <input class="submit-button" type="submit" name="filter" value="Filter"> 
      </form> 
     </div> 
     <div class="posts"> 
      <div id="adcat"><?php 
       if(!empty($cat2)){ 
        ?> 
        <a href="cat.php?catid=<?php echo $l1; ?>" ><?php echo $cat1." » "; ?></a><span><?php echo $cat2; ?></span> 
        <?php 
       } else { 
       echo "<font color='grey'>".$cat1."</font>"; 
       } 
         ?> 
      </div><br><br> 
      <div id="detailformscat"> 
        <?php 
        if(empty($p1) && empty($p2)){ 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } else if(!empty($p2)){ 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE catid='$p2' "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } else { 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE p.catid LIKE '$p1%' "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } 
        $res = mysqli_query($connect,$sql); 
        while ($row = mysqli_fetch_assoc($res)) { 
         $postid = $row["postid"]; 
         ?> 
         <div id="ads"> 
          <div id="adfavcat"> 
            <?php if(!isset($_SESSION["userid"])) { ?> 
            <a href="post.php?login=false" ><img src="image/+fav.png" width="40px" height="40px"></a> 
            <?php } else { 

              $userid = $_SESSION["userid"]; 
              $sql2 = "SELECT * FROM fav WHERE userid='$userid' AND postid='$postid' "; 
              $res2 = mysqli_query($connect,$sql2); 
              $rowcount = mysqli_num_rows($res2); 

              if ($rowcount > 0){ ?> 
               <a href="cat.php?catid=<?php echo $catid; ?>&delete&id=<?php echo $postid?>" ><img src="image/xfav.png" width="40px" height="40px"></a> 
              <?php 
              } else { ?> 
              <a href="cat.php?catid=<?php echo $catid; ?>&add&id=<?php echo $postid; ?>" ><img src="image/+fav.png" width="40px" height="40px"></a> 
              <?php } 
            } ?> 

          </div> 
          <div id="titlepic"> 
          <a href="review.php?id=<?php echo $postid; ?>"><?php echo $row["title"]; ?></a><br> 
          <a href="review.php?id=<?php echo $postid; ?>"><img src="<?php if(!empty($row["path1"])) { echo $row["path1"]; } else echo "image/noimage.png"; ?>" height="100px" width="150px"></a> 
          </div> 
          <div id="datescat"> 
           <b>Date Added:</b> <?php echo date('m/d/Y H:i', $row["dateadded"]); ?><br> 
           <b>Renew Date:</b> <?php if($row["renewdate"] > 0){ echo date('m/d/Y H:i', $row["renewdate"]); } ?><br> 
           <b>Location:</b> <?php echo $row["location"]; ?><br> 
           <b>Price:</b> <?php echo $row["price"]."&pound"; ?><br> 

          </div> 
         </div> 
         <hr width="100%"> 
         <?php 
        } 

       ?> 
     </div> 
      </div> 
    </div> 

Answer 1

我想這是因爲你是治療的價格爲字符串，在你寫

$sql.= "AND price>='$min' "; 

SQL查詢

嘗試使用cast/sanitize/filter輸入變量$ min & $ max到整數並刪除t他引用。

---順便說一下，我個人也改變了一些東西：

1. 使用原子代替括號
2. 使用ORM並刪除從HTML頁面的查詢（視圖）
3. 如果2是不可能的，嘗試所有的PHP邏輯移動到PHP文件而不是HTML部分
4. 刪除所有國際單項體育聯合會，並嘗試編寫代碼，而無需大量的重複

---

您還加入了表而不是過濾，嘗試改變

$sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid "; 

與

$sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE p.id > 0 "; 

---

變化

$pricemin = ''; 
$pricemax = ''; 

與

$min = ''; 
$max = '';