你可以在WHERE子句中使用$ _POST

Question

對此沒有真正直接的答案，所以我想我會放棄它。

$myid = $_POST['id']; 

     //Select the post from the database according to the id. 
    $query = mysql_query("SELECT * FROM repairs WHERE id = " .$myid . " AND name = '' AND email = '' AND address1 = '' AND postcode = '';") or die(header('Location: 404.php')); 

上面的代碼應該設置變量$本身份識別碼作爲ID的張貼內容，變量然後在SQL WHERE子句中使用從數據庫根據所提交的ID獲取數據。忘記潛在的SQL注入（我會稍後解決它們）爲什麼這不起作用？

好這裏是我對它的測試的完整代碼：

<?php 

//This includes the variables, adjusted within the 'config.php file' and the functions from the 'functions.php' - the config variables are adjusted prior to anything else. 
require('configs/config.php'); 
require('configs/functions.php'); 

//Check to see if the form has been submited, if it has we continue with the script. 
if(isset($_POST['confirmation']) and $_POST['confirmation']=='true') 
{ 
    //Slashes are removed, depending on configuration. 
    if(get_magic_quotes_gpc()) 
    { 
     $_POST['model'] = stripslashes($_POST['model']); 
     $_POST['problem'] = stripslashes($_POST['problem']); 
     $_POST['info'] = stripslashes($_POST['info']); 
    } 
    //Create the future ID of the post - obviously this will create and give the id of the post, it is generated in numerical order. 
    $maxid = mysql_fetch_array(mysql_query('select max(id) as id from repairs')); 
    $id = intval($maxid['id'])+1; 

    //Here the variables are protected using PHP and the input fields are also limited, where applicable. 
    $model = mysql_escape_string(substr($_POST['model'],0,9)); 
    $problem = mysql_escape_string(substr($_POST['problem'],0,255)); 
    $info = mysql_escape_string(substr($_POST['info'],0,6000)); 

    //The post information is submitted into the database, the admin is then forwarded to the page for the new post. Else a warning is displayed and the admin is forwarded back to the new post page. 
    if(mysql_query("insert into repairs (id, model, problem, info) values ('$_POST[id]', '$_POST[model]', '$_POST[version]', '$_POST[info]')")) 
    { 

?> 

<?php 

$myid = $_POST['id']; 

     //Select the post from the database according to the id. 
    $query = mysql_query("SELECT * FROM repairs WHERE id=" .$myid . " AND name = '' AND email = '' AND address1 = '' AND postcode = '';") or die(header('Location: 404.php')); 

     //This re-directs to an error page the user preventing them from viewing the page if there are no rows with data equal to the query. 
    if(mysql_num_rows($query) < 1) 
{ 
header('Location: 404.php'); 
exit; 
} 

    //Assign variable names to each column in the database. 
    while($row = mysql_fetch_array($query)) 
    { 
     $model = $row['model']; 
     $problem = $row['problem']; 
    } 

      //Select the post from the database according to the id. 
    $query2 = mysql_query('SELECT * FROM devices WHERE version = "'.$model.'" AND issue = "'.$problem.'";') or die(header('Location: 404.php')); 

     //This re-directs to an error page the user preventing them from viewing the page if there are no rows with data equal to the query. 
    if(mysql_num_rows($query2) < 1) 
{ 
header('Location: 404.php'); 
exit; 
} 

    //Assign variable names to each column in the database. 
    while($row2 = mysql_fetch_array($query2)) 
    { 
     $price = $row2['price']; 
     $device = $row2['device']; 
     $image = $row2['image']; 
    } 

?> 

<?php echo $id; ?> 
<?php echo $model; ?> 
<?php echo $problem; ?> 
<?php echo $price; ?> 
<?php echo $device; ?> 
<?php echo $image; ?> 

    <? 
    } 
    else 
    { 
     echo '<meta http-equiv="refresh" content="2; URL=iphone.php"><div id="confirms" style="text-align:center;">Oops! An error occurred while submitting the post! Try again…</div></br>'; 
    } 
} 
?> 

Answer 1

表中的數據類型是什麼？你可能需要用單引號括起來。

$query = msql_query("SELECT * FROM repairs WHERE id = '$myid' AND...") 

編輯：你也不需要使用雙引號字符串連接。

Answer 2

1. 檢查$身份識別碼和整個動態創建的SQL字符串的值，以確保它包含了什麼你認爲它包含的內容。

2. 這很可能是因爲對可能包含NULL值的列使用空字符串比較而引起的問題。對所有空字符串嘗試使用name IS NULL等等。

Answer 3

$myid將是空的唯一原因是，如果它沒有被瀏覽器發送。確保您的表單操作已設置爲POST。您可以驗證有值$_POST下列要求：

print_r($_POST); 

而且，呼應了您的查詢，以確保它是你希望它是什麼。嘗試通過PHPMyAdmin或MySQL Workbench手動運行它。

Answer 4

使用$something = mysql_real_escape_string($POST['something']);
難道不僅防止SQL注入，還可以防止語法錯誤由於人們進入像數據：所以爲了有一個有效的和工作應用它確實是

name = O'Reilly <<-- query will bomb with an error 
memo = Chairman said: "welcome" 
etc. 

是必不可少的。
的"I'll fix it later"的說法有一些邏輯上的缺陷：

• 這是後期較慢修復的東西，你會花更多的時間整體，因爲你需要重新審視舊的代碼。
• 由於上述功能錯誤，您將在測試中收到不需要的錯誤報告。
• 我會做，以後thingies往往永遠不會發生。
• 安全性不是可選的，它是必不可少的。
• 如果你完成項目並且其他人需要接管，他將不知道你的未解決問題會發生什麼。
• 如果你做了什麼，完成它，不要留下任何未解決的問題。
• 如果我是您的老闆並對該代碼進行了代碼審查，您將被當場解僱。