Question

可能重复：
Display Data From MYSQL; SQL statement error

我有以下代码显示来自MYSQL数据库的数据（目前正在查看sql注入问题）我需要在没有找到结果时插入错误消息...不确定在哪里定位这个！我已尝试过代码if（mysql_num_rows（$ result）== 0）{ 回声“找不到行！”但是继续使用gettin语法错误，有没有人知道代码中的正确位置？

-

 require 'defaults.php';
 require 'database.php';

 /* get properties from database */

 $property = $_GET['bedrooms'] ;
 $sleeps_min = $_GET['sleeps_min'] ;
 $availability = $_GET['availability'] ;


  $query = "SELECT * FROM `properties` WHERE bedrooms = '{$bedrooms}' AND sleeps_min = '{$sleeps_min}' AND availability = '{$availability}'";
  $row=mysql_query($query);

  $result = do_query("SELECT * FROM `properties` WHERE bedrooms = '{$bedrooms}' sleeps_min = '{$sleeps_min}' AND availability = '{$availability}'", $db_connection);

 while ($row = mysql_fetch_assoc($result))
 {
$r[] = $row;
 }

 ?>

Answer 1

执行var_dump($GET_)调试是否获得有效的字符串。如果其中任何一个为空，则查询将尝试匹配空值而不是NULL。你应该通过这样做来防止这种情况：

if(!$_GET['bedrooms'] || $_GET['bedrooms'] == ''){
$property = 'NULL';
}//repeat for all three

$query = "SELECT * FROM `properties` WHERE 'bedrooms' = '$bedrooms' AND 'sleeps_min' = '$sleeps_min' AND 'availability' = '$availability'";

而不是：

while ($row = mysql_fetch_assoc($result)) {
    $r[] = $row; 
}

您可以这样做：

$r = mysql_fetch_array($query);

但请将其包含在条件中以查看您的查询是否找到了任何内容：

if(mysql_affected_rows() > 0){
  //your code here will execute when there is at least one result
  $r = mysql_fetch_array($query); 
} 
else{//There was either nothing or an error
  if(mysql_affected_rows() == 0){
    //There were 0 results 
  } 
  if(mysql_affected_rows() == -1) {
    //This executes when there is an error 
    print mysql_error(); //not recommended except to debug
  }
}

Answer 2

我发现你的代码中有一些错误在行

$query = "SELECT * FROM `properties` WHERE bedrooms = '{$bedrooms}' AND sleeps_min = '{$sleeps_min}' AND availability = '{$availability}'";
$row=mysql_query($query);

您使用bedrooms = '{$bedrooms}'但$bedrooms is not variable in whole cod it must be $preopery。我在下面的代码中做了一些更改，请尝试一下。

        <?php

        require 'defaults.php';
        require 'database.php';

        /* get properties from database */

        /*if get $_GET['bedrooms'] value else ''*/

        if (isset($_GET['bedrooms'])) {
            $property = $_GET['bedrooms'];
        } else {
            $property = '';
        }

        /*if get $_GET['sleeps_min'] value else ''*/

        if (isset($_GET['sleeps_min'])) {
            $sleeps_min = $_GET['sleeps_min'];
        } else {
            $sleeps_min = '';
        }

        /*if get $_GET['availability'] value else ''*/

        if (isset($_GET['availability'])) {
            $availability = $_GET['availability'];
        } else {
            $availability = '';
        }

        $query = "SELECT * FROM `properties` WHERE bedrooms = '" . $property . "' AND sleeps_min = '" . $sleeps_min . "' AND availability = '" . $availability . "'";

        $result = mysql_query($query) or die(mysql_error());

        if ($result) {
            while ($row = mysql_fetch_assoc($result)) {
                $r[] = $row;
            }
        }
        ?>

MYSQL结果;没有记录发现声明

2 个答案: