提交PHP表單後顯示查詢結果

Question

我目前正在使用php和mysql進行學校項目。我創建了一個包含三個下拉框的表單，供用戶選擇要查找的數據類型。但是，在提交表單後，我顯示結果很麻煩。這是我目前的代碼：

<?php 
require_once 'connection.php'; 
?> 


<form action="stats.php" method ="post"> 
<input type="hidden" name="submitted" value="true" /> 

<fieldset> 
<legend> 
Specify Date, Month, and County 
</legend> 
<p> 
<label for="year"> 
Please select a year 
</label> 

<select name= 'year'> 
<?php 
$query = "select distinct year from unemployed"; 

$result = $conn->query($query); 
while($row = $result->fetch_object()) { 
    echo "<option value='".$row->year."'>".$row->year."</option>"; 
} 
?> 
</select> 
</p> 

<p> 
<label for="month"> 
Please select a month 
<label> 

<select name= 'month'> 
<?php 
$query = "select distinct month from unemployed"; 

$result = $conn->query($query); 
while($row = $result->fetch_object()) { 
    echo "<option value='".$row->month."'>".$row->month."</option>"; 
} 
?> 
</select> 
</p> 

<p> 
<label for="location"> 
Please specify a location 
</label> 

<select name='select'> 
<?php 
$query = "select * from unemployed"; 

$result = $conn->query($query); 

while ($finfo = $result->fetch_field()) { 
    echo "<option value='".$finfo->name."'>".$finfo->name."</option>"; 
} 

?> 
</select> 
</p> 


<input type ="submit" /> 

</fieldset> 
</form> 

<?php 

if (isset($_POST['submitted'])) { 

include('connection.php'); 

$gYear = $_POST["year"]; 
$gMonth = $_POST["month"]; 
$gSelect = $_POST["select"]; 

$query = "select $gSelect from unemployed where year='$gYear' and month='$gMonth'"; 

$result = $conn->query($query) or die('error getting data'); 


echo"<table>"; 
echo "<tr><th>Year</th><th>Time</th><th>$gSelect</th></tr>"; 

while ($row = $result->fetch_object()){ 

echo "<tr><td>"; 
echo $row['Year']; 
echo "</td><td>"; 
echo $row['Month']; 
echo "</td><td>"; 
echo $row['$gSelect']; 
echo "</td></tr>"; 

} 




echo "</table"; 

} // end of main if statement 

?> 

我幾乎可以肯定我的問題在於我的while語句。我得到了表格列的標題（Year，Month，$ gSelect），但我沒有看到我的查詢結果顯示。

我曾嘗試：

while ($row = $result->fetch_object()) 

while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC)) 

這些都不是爲我工作。我已經看過php.net的指導。我仍然對做什麼感到困惑。如果有人能幫助我，我會非常感激。

Answer 1

經常檢查您的回報：

if(! $result = $conn->query($query)) { 
    die('Error: ' . $conn->error()); 
} else { 
    while($row = $result->fetch_object()) { 
    echo "<option value='".$row->year."'>".$row->year."</option>"; 
    } 
} 

而且把error_reporting(E_ALL);在腳本的頂部，當你開發這將有助於極大地爲好。

Answer 2

你應該真的把傳遞變量看作是你的查詢的參數，而不是直接將它們作爲變量注入你的查詢。這可能會導致SQL注入攻擊。

而且，這裏有一個如何編寫使用PDO和MySQL查詢一個簡單的例子：

//Simple Query 
$dbh = new PDO('mysql:host=localhost;dbname=testdb;charset=utf8', 'username', 'password'); 
//Useful during development. 
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
//mysql can have prepares depending on the version: http://stackoverflow.com/questions/10113562/pdo-mysql-use-pdoattr-emulate-prepares-or-not 
$dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); 
$sth = $dbh->query("SELECT * FROM table"); 
var_dump($sth->fetchAll(PDO::FETCH_ASSOC)); 
//Now with pass params and a prepared statement: 
$query = "SELECT * FROM table WHERE someCol = ?"; 
$sth = $dbh->prepare($query); 
$sth->bindValue(1,"SomeValue"); 
$sth->execute(); 
$results = $sth->fetchAll(PDO::FETCH_ASSOC));