Question

我希望有人会帮助我。 :(这是我的错误信息。提前谢谢。

desc

这也是我的代码。

<tr>
                <td><label for="cname">Client Name:</label></td>
                <td><select name="cname" id="cname">
                        <option>Choose</option>
                        <?php
                            include("alqdb.php");
                            $result=mysqli_query($con, "SELECT ClientName FROM events");
                            while($row=mysqli_fetch_assoc($result)){
                                echo "<option>".$row["ClientName"]."</option>";
                            }
                        ?>
                        </select>
                </td>
            </tr>
            <tr>
                <td><label for="survey">Survey:</label></td>
                <td><select name="survey" id="survey">
                        <option>Choose</option>
                        <?php
                            include("alqdb.php");
                            $result=mysqli_query($con, "SELECT * FROM events WHERE ClientName = '"$_POST['cname']"'");
                            while($row=mysqli_fetch_assoc($result)){
                                echo "<option>".$row["EventTitle"]."</option>";
                            }
                        ?>
                        </select>
                </td>
            </tr>

Answer 1

你需要concatenate正确的字符串：

$result=mysqli_query($con, "SELECT * FROM events WHERE ClientName = '".$_POST['cname']."'");

请注意变量两侧的句点。或者你可以用括号括起来：

$result=mysqli_query($con, "SELECT * FROM events WHERE ClientName = '{$_POST['cname']}'");

在任何情况下，您都可以进行SQL注入。查看准备好的陈述，你不会遇到这种问题。

Answer 2

使用PDO并准备语句以确保安全。此外，您还要包括两次数据库，只需要包含一次。

将您的日期库文件更改为此。

try {
  $db = new PDO("mysql:host=localhost;dbname=second;port=8889","root","root");
  $db->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);
  $db->exec("SET NAMES 'utf8'");
} catch (Exception $e){
  echo 'Could not connect to the database.';
  exit();
}

然后，当您想要安全地使用数据库时，请使用此

$foo = trim(htmlspecialchars($_POST['cname']));//depending on where your information comes from, you might want to use htmlspecialchars

try{
  $results = $db->prepare("SELECT * FROM events WHERE ClientName = ?");
  $results->bindParam(1,$foo);// you can also use bindValue here if you intend to use a for loop
  $results->execute();
  $hold = $results->fetchAll(PDO::FETCH_ASSOC);
} catch (Exception $e) {
  echo "Data could not be retrieved from the database.";
  exit();
}
foreach($hold as $value){
    echo $value['ClientName'];
}

Answer 3

试试这个：

... "SELECT * FROM events WHERE ClientName = '" . $_POST['cname'] . "'"

但请注意您的代码将允许SQL注入！您的帖子应该在...之前转义。

请参阅：SQL Injection

意外的'$ _POST'错误消息

3 个答案: