Question

我有这个新闻系统，但我无法弄清楚如何这样做：news.php?id=1然后它将输出新闻ID 1.请帮助。

到目前为止，我有这个：

<?php
include_once('includes/config.php');
if($id != "") {
    $id = mysql_real_escape_string($id);
    $sql = mysql_query("SELECT * FROM news WHERE id = '$id'");
}
$res = mysql_query($sql);
while($row = mysql_fetch_assoc($res)){
if(isset($_GET['id']));
    echo $res['body'];
}
?>

它连接到数据库（详细信息存储在配置中）。

Answer 1

之后的参数？在URL中是GET项目。使用此：

<?php

if (isset($_GET['id'])) {

    $id = $_GET['id'];
    // Rest of your code

}

Answer 2

<?php
include_once('includes/config.php');

// see if the id is set in the URL (news.php?id=)
if(isset($_GET['id'])) {

    // get the ID from the URL
    // to make it safer: strip any tags (if it's a number we could cast it to an integer)
    $id = strip_tags($_GET['id']);

    // don't use SELECT *, select only the fields you need
    $sql = mysql_query("SELECT body FROM news WHERE id=".mysql_real_escape_string($id));

    while($row = mysql_fetch_assoc($sql)) {
        echo $res['body'];
    }
} else {
    echo 'please select an article';
}

我建议您不要使用mysql函数，而是使用mysqli，因为mysql已弃用，您必须学习mysqli或{{ 1}}无论如何。

编辑：每条评论更新的代码

Answer 3

首先让我们剖析您当前的代码，看看哪里出错了。

<?php
include_once('includes/config.php');
/*
$id is not set anywhere before its used so this if statement will not fire,
if you are attempting to get this $id from a url parameter then you need
to set it first from $_GET['id'] global
*/
if($id != "") {
    $id = mysql_real_escape_string($id);
    $sql = mysql_query("SELECT * FROM news WHERE id = '$id'");
}
/*
This piece of code will fire but where is $sql set?
The mysql_query() function expects a string containing your sql query
so the subsequent lines of code will fail because of this
*/
$res = mysql_query($sql);
while($row = mysql_fetch_assoc($res)){
    //this block is in the wrong place
    if(isset($_GET['id']));
    echo $res['body'];

}
?>

我们的想法是让用户首先从网址输入E.G $_GET['id']，检查值是您要查找的内容，然后构建您的查询。

由于mysql_*函数已弃用，我将向您展示一个使用PDO的示例。虽然您可以使用mysqli，但是只要用户值与您的数据库接触，您就必须始终使用准备好的查询。这是为了阻止令人讨厌/意外的SQL注入。

<?php 
// make the connection to the database using PDO
try {
    $db = new PDO('mysql:host=127.0.0.1;dbname=the_awsome_db', 'yourusername', 'password');
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
    $db->exec("SET CHARACTER SET utf8");

} catch(PDOException $e) {
    exit('Sorry there is a problem with the database connection :' . $e->getMessage());
}

// sanitize user input - expecting an int
$id = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);

if (is_numeric($id)) {
    // now lets query the database with the param id from the user

    // prepare the query, using a placeholder
    $stmt = $db->prepare('SELECT body, 
                                 some_other_column 
                          FROM news 
                          WHERE id = :placeholder_id');

    // bind the placeholder with the value from the user
    $stmt->bindParam(':placeholder_id', $id);

    // execute the prepared query
    $stmt->execute();

    // fetch the result
    $result = $stmt->fetch(PDO::FETCH_ASSOC);

    // result not empty - display
    if (!empty($result)) {
        // display your result, use print_r($result) to view the whole result set if unsure
        echo $result['body'];
    } else {
        // no matching id found in the db, do something
        echo 'No results found';
    }
} else {
    // do something as user input is not a number
    exit(header('Location: ./index.php'));
}
?>

希望它有所帮助，如果您不确定从用户那里获取参数，您可能需要先查看更多教程，然后在涉及数据库和所有好东西之前先了解它。

MYSQL＆amp; PHP新闻系统

3 个答案: