Question

以下代码的目的是从用户获取数据库中customerID的输入（来自单独的HTML文件），然后显示该customerID的订单号，订单日期和发货状态。代码工作正常，我能够做到这一点，但是如果输入数据库中不存在的customerID，我也想创建一条错误消息，而不仅仅是一个空表。我是PHP的新手，对于如何做到这一点的任何帮助表示赞赏。（请注意，它必须是PHP或mysql）

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Prac 2 Task 8</title>
</head>
<body>
<?php
$conn = mysql_connect("localhost", "<username>", "<password>");
mysql_select_db("warehouse<##>", $conn) 
or die ('Database not found ' . mysql_error() );
$input = $_GET["custID"];
$sql = "select orderNumber, orderDate, shipped from orders where customerID = $input 
order by orderDate"; 
$rs = mysql_query($sql, $conn)
or die ('Problem with query' . mysql_error());
?>
<?php 
if (orderNumber != "") { ?> 
<p>the following information was received from the user:</p>
<p><strong>customerID = </strong> <?php echo "$input"; ?><br/><br/>

<table border="1" summary="Order Details">
<tr>
<th>Order Number</th>
<th>Order Date</th>
<th>Shipped</th>
</tr>
<?php
while ($row = mysql_fetch_array($rs)) { ?>
<tr>
<td><?php echo $row["orderNumber"]?></td>
<td><?php echo $row["orderDate"]?></td>
<td><?php echo $row["shipped"]?></td>

</tr>
<?php }}
else {
$txt ="The CustomerID you entered was either invalid or does not exist"; 
echo $txt;?>
<?php }
mysql_close($conn); ?>
</table>
</body></html>

Answer 1

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Prac 2 Task 8</title>
</head>
<body>
<?php
$conn = mysql_connect("localhost", "<username>", "<password>");
mysql_select_db("warehouse<##>", $conn) 
or die ('Database not found ' . mysql_error() );
$input = $_GET["custID"];
$sql = "select orderNumber, orderDate, shipped from orders where customerID = $input 
order by orderDate"; 
$rs = mysql_query($sql, $conn)
or die ('Problem with query' . mysql_error());
//validate result set here
if(mysql_num_rows($rs)>0)
{
?>
<?php 
if (orderNumber != "") { ?> 
<p>the following information was received from the user:</p>
<p><strong>customerID = </strong> <?php echo "$input"; ?><br/><br/>

<table border="1" summary="Order Details">
<tr>
<th>Order Number</th>
<th>Order Date</th>
<th>Shipped</th>
</tr>
<?php
while ($row = mysql_fetch_array($rs)) { ?>
<tr>
<td><?php echo $row["orderNumber"]?></td>
<td><?php echo $row["orderDate"]?></td>
<td><?php echo $row["shipped"]?></td>

</tr>
<?php }}
else {
$txt ="The CustomerID you entered was either invalid or does not exist"; 
echo $txt;?>
<?php }

}//endif
else{

//you error message here
}

mysql_close($conn); ?>
</table>
</body></html>

Answer 2

你有很多方法可以做到这一点，这是其中之一：

将您的代码封装到try-catch中，因此很容易管理错误，比使用“或死”的东西要好得多
验证GET和POST变量的有效性，以避免SQL注入的安全性
您可以在主查询之前使用“选择计数（*）...”，或者只计算主查询的结果数量（我放在那里）

这给出了大约：

<body>
<?php
$conn = mysql_connect("localhost", "<username>", "<password>");
mysql_select_db("warehouse<##>", $conn) 
or die ('Database not found ' . mysql_error() );

try 
{
  $input = $_GET["custID"];
  // Protect yourself from SQL injection
  if (!is_numeric($input))
    throw new Exception('Error: the customer ID is not a number');

  $sql = "select orderNumber, orderDate, shipped from orders where customerID = $input 
  order by orderDate"; 
  $rs = mysql_query($sql, $conn)
    or die ('Problem with query' . mysql_error());
  ?>
  <?php 
  if ( mysql_num_rows($rs) > 0 )
  { ?> 
  <p>the following information was received from the user:</p>
  <p><strong>customerID = </strong> <?php echo "$input"; ?><br/><br/>

  <table border="1" summary="Order Details">
  <tr>
  <th>Order Number</th>
  <th>Order Date</th>
  <th>Shipped</th>
  </tr>
  <?php
  while ($row = mysql_fetch_array($rs)) { ?>
  <tr>
  <td><?php echo $row["orderNumber"]?></td>
  <td><?php echo $row["orderDate"]?></td>
  <td><?php echo $row["shipped"]?></td>

  </tr>
  <?php }
    else
    {
      echo "There is no results for this customer";
    }
  }
  else {
  $txt ="The CustomerID you entered was either invalid or does not exist"; 
  echo $txt;?>
  <?php }
}
catch (Exception $e)
{
  echo "Error: ".$e;
}
mysql_close($conn); ?>
</table>
</body>

在PHP中为空数据库查询生成错误消息

2 个答案: