0
我仍然無法獲得正確的流程。我知道這很簡單，我認爲我的代碼是正確的，但即使輸入框爲空，當我點擊購買按鈕時仍然顯示警告消息。我想要的是，如果輸入框爲空，但如果輸入框已填充，則不會顯示警報消息;否則，單擊按鈕時警報消息將顯示的唯一時間。這裏是我的代碼：形式提示信息
<?php
require_once('auth.php');
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Athan Motorcycle</title>
<style type="text/css">
<!--
.style1 {
color: #000000;
font-weight: bold;
font-size: 24px;
}
-->
</style>
<!--<script type="text/javascript">
function validateForm()
{
var a=document.forms["abc"]["qty"].value;
if ((a==null || a==""))
{
alert("Please specify the quantity.");
return false;
}
}
</script>-->
</head>
<body>
<form action="saveorder.php" name="abc" method="post">
<input name="id" type="hidden" value="<?php echo $_SESSION['SESS_MEMBER_ID']; ?>" />
<input name="transcode" type="hidden" value="<?php echo $_SESSION['SESS_FIRST_NAME']; ?>" />
<table width="400" border="0" cellpadding="0" cellspacing="0">
<?php
if (isset($_GET['id']))
{
include('config.php');
$id=$_GET['id'];
$result = mysql_query("SELECT * FROM athan_products WHERE product_id = $id and status='available'");
$row3 = mysql_fetch_array($result);
echo '<tr>';
echo '<td width="80"><img alt="Motor" src="images/motor/'.$row3['product_photo'].'" /></td>';
echo '<td width="200"><span class="style1">'.'</span></td>';
echo '<td width="120"></span></td>';
echo '</tr>';
echo '<tr>';
echo '<td width="80"><input name="name" type="text" value="'.$row3['partsname'].'" readonly/><input name="ingre" type="hidden" value="'.$row3['product_ingredients'].'"/> <input name="ids" type="hidden" value="'.$row3['id'].'"/></td>';
echo '<td width="120"></span></td>';
echo '</tr>';
}
?>
</table>
<br />
<label style="color:#000000;">Qty:
<input type="number" min="1" id="qty" name="qty" required = "required" />
</label>
<br />
<table width="400" border="0" cellpadding="0" cellspacing="0" style="color:#000000;">
<tr>
<!--<td width="179">Size</td>-->
<td width="128">Price</td>
<td width="179">Description</td>
<td width="93">Selection</td>
</tr>
<?php
if (isset($_GET['id']))
{
include('config.php');
$id=$_GET['id'];
$result = mysql_query("SELECT * FROM athan_products WHERE product_id = $id");
while($row3 = mysql_fetch_array($result))
{
$resultq = mysql_query("SELECT * FROM inventory WHERE product_id LIKE '%".$id."%'");
//$resultq = mysql_query("SELECT * FROM inventory WHERE product_id LIKE =$id");
while($rows = mysql_fetch_array($resultq))
{
$qwerty=$rows['qtyleft'];
}
if ($qwerty !=0){
echo '<tr>';
//echo '<td>'.$row3['product_size_name'].'</td>';
echo '<td>'.$row3['price'].'</td>';
echo '<td>'.$row3['description'].'</td>';
echo '<td>'.'<input name="but" type="image" value="'.$row3['id'].'" src="images/button.png" onclick="return myFunction()" />'.'</td>';
echo '</tr>';
}
else
{
echo '"This Item is not Available"';
//echo '<td>'.'<h1>'.'"not available"'.'</h1>'.'</td>';
}
}
}
?>
</table>
</form>
<script type="text/javascript">
function myFunction()
{
var a=document.forms["abc"]["qty"].value;
if (a!=null || a!= ""){
alert("Item has been successfully added to your Cart");
}
}
</script>
</body>
</html>
請不要像這樣將變量傳遞到SQL中...如果將id設置爲「index.php？id = true」，您將獲得所有內容，並且情況會變得更糟......如果有人將其設置爲「1 UNION SELECT字段FROM表「，他們可以從其他表（即列出用戶表中的用戶名和電子郵件地址）......這就是所謂的SQL注入。 –