無法在PHP中搜索OR語句MySQL Query

Question

目前正在構建CRUD系統以跟蹤產品編號。在我爲搜索設置的查詢中，除了'p.name'之外，它似乎沒有提取任何內容，但是不會提取任何其他內容，無論我是在WHERE語句中將它放在第一位還是第二位進行搜索功能。

但是，如果我改變第二個函數中的p.name爲其他東西，它會選擇它。

如果我添加「OR p.family LIKE？」該查詢將不會執行。

這是用於產品搜索的代碼。我添加了一條評論「// - 我可以在這裏添加另一個LIKE嗎？」

<?php 
class Product{ 

    // database connection and table name 
    private $conn; 
    private $table_name = "products"; 
    private $table2_name = "deleted_products"; 

    // object properties 
    public $id; 
    public $name; 
    public $family; 
    public $number; 
    public $description; 
    public $ext_description; 
    public $category_id; 
    public $timestamp; 
    public $timestamp2; 

    public function __construct($db){ 
     $this->conn = $db; 
    } 

     public function search($search_term, $from_record_num, $records_per_page){ 

     // select query 
     $query = "SELECT 
        c.name as category_name, p.id, p.name, p.family, p.description, p.ext_description, p.number, p.category_id, p.created 
       FROM 
        " . $this->table_name . " p 
        LEFT JOIN 
         categories c 
          ON p.category_id = c.id 
       WHERE 
        p.family LIKE ? OR p.description LIKE ? 
       ORDER BY 
        p.name ASC 
       LIMIT 
        ?, ?"; 

     // prepare query statement 
     $stmt = $this->conn->prepare($query); 

     // bind variable values 
     $search_term = "%{$search_term}%"; 
     $stmt->bindParam(1, $search_term); 
     $stmt->bindParam(2, $search_term); 
     $stmt->bindParam(3, $from_record_num, PDO::PARAM_INT); 
     $stmt->bindParam(4, $records_per_page, PDO::PARAM_INT); 

     // execute query 
     $stmt->execute(); 

     // return values from database 
     return $stmt; 
    } 

    public function countAll_BySearch($search_term){ 

     // select query 
     $query = "SELECT 
        COUNT(*) as total_rows 
       FROM 
        " . $this->table_name . " p 
        LEFT JOIN 
         categories c 
          ON p.category_id = c.id 
       WHERE 
        p.name LIKE ?"; // ---- Can I add another LIKE here? 

     // prepare query statement 
     $stmt = $this->conn->prepare($query); 

     // bind variable values 
     $search_term = "%{$search_term}%"; 
     $stmt->bindParam(1, $search_term); 

     $stmt->execute(); 
     $row = $stmt->fetch(PDO::FETCH_ASSOC); 

     return $row['total_rows']; 
    } 

} 

下面是用於搜索

<?php 
// core.php holds pagination variables 
include_once 'config/core.php'; 

// include database and object files 
include_once 'config/database.php'; 
include_once 'objects/product.php'; 
include_once 'objects/category.php'; 

// instantiate database and product object 
$database = new Database(); 
$db = $database->getConnection(); 

$product = new Product($db); 
$category = new Category($db); 

// get search term 
$search_term=isset($_GET['s']) ? $_GET['s'] : ''; 

$page_title = "You searched for \"{$search_term}\""; 
include_once "header.php"; 

// query products 
$stmt = $product->search($search_term, $from_record_num, $records_per_page); 
//$stmt = $product->readAll($from_record_num, $records_per_page); 

// specify the page where paging is used 
$page_url="search.php?s={$search_term}&"; 

// count total rows - used for pagination 
$total_rows=$product->countAll_BySearch($search_term); 

// read_template.php controls how the product list will be rendered 
include_once "read_template.php"; 

// footer.php holds our javascript and closing html tags 
include_once "footer.php"; 
?> 

頁面如果有人可以幫助我走出這將是偉大的！謝謝。

Answer 1

你應該可以像你在第一個例子中那樣做。您需要查詢中每個值的佔位符，然後您需要爲每個佔位符綁定一個。

$query = "SELECT 
      COUNT(*) as total_rows 
      FROM 
      " . $this->table_name . " p 
      LEFT JOIN 
      categories c 
      ON p.category_id = c.id 
      WHERE 
      p.name LIKE ? OR p.description LIKE ?";  

// prepare query statement 
$stmt = $this->conn->prepare($query); 
// bind variable values 
$search_term = "%{$search_term}%"; 
$stmt->bindParam(1, $search_term); 
$stmt->bindParam(2, $search_term); 

的bindParam函數的第一個參數是如何映射到在查詢中的佔位符，1意味着它會與第一個佔位符。另一種語法是通過execute中的綁定。

$stmt = $this->conn->prepare($query); 
$search_term = "%{$search_term}%"; 
$stmt->execute(array($search_term, $search_term)); 

此外，直接在DOM中使用用戶提供的數據可以打開XSS注入。您應該避免輸入，以免惡意代碼無法執行。

$search_term=isset($_GET['s']) ? htmlspecialchars($_GET['s'], ENT_QUOTES) : ''; 

1. https://en.wikipedia.org/wiki/Cross-site_scripting
2. https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)