Question

我试图搜索2013年约翰杰克逊待付款的报告，但它没有产生结果。

这假设当我插入name=John Jackson，class=grade one和year=2013时，查询假设在设置表中检查year= 2013的设置字段值并减去约翰从2013年的付款表中支付的金额。

我有两张桌子的付款和设置'

Note that I'w mention some of fields

付款表（用于存储付款信息）

id  fname        class     school_fee boarding exam_paper lunch date        year
1   John Jackson Grade one 100000     300000   30000      1000  2013-12-12  0000-00-00

设置表（用于存储每年实际支付的服务）

id boarding_setting exampaper_setting fee_setting lunch_setting  year       date
1  200000           30000             200000      180000         2013-12-18 NULL 
   300000           40000             300000      190000         2014-12-12 NULL

在设置表中，我把某项服务的实际支付一年，这样当学生支付例子（school_fee）时，设置表中的fee_setting字段将减去根据发布的年份支付表中支付的school_fee的数量。

这里是php脚本加入两个表并查询表中的信息;

  <?php include("../Connections/conn.php")?>                       
    <?php
    $fname="fname";
    $date="date";
    $class="class";

    if(isset($_REQUEST['submit'])){
    $fname=$_POST['fname'];
    $date=$_POST['year'];
    $class=$_POST['class'];


     $sql2="SELECT SUM(boarding)as boarding,SUM(exam_paper)as 
     exam_paper,SUM(school_fee)as  
     school_fee,SUM(lunch)as lunch,fname,class,date,year  
     FROM payment
     WHERE YEAR(date) = '$date' AND fname like '%".$fname."%' AND class like 
    '%".$class."%' AND    
     date like '%".$date."%' UNION  
     SELECT(boarding_setting,exampaper_setting,fee_setting,lunch_setting,year,date   
      ) 
    FROM setting WHERE YEAR(date) = '$date' AND fname like '%".$fname."%' AND class 
    like  '%".$class."%' AND date like '%".$date."%'"; 

    $q=mysql_query($sql2);  

      }
    else{
   $sql="SELECT * FROM payment";
   $q=mysql_query($sql);
      }
       ?>

这是我用来输入搜索信息的表格

<form method="post">
<table width="500" border="0">
<tr>
<td>Student name</td>
<td><input type="text" name="fname" value="<?php echo $fname;?>" /></td>

<td>Class</td>
<td><input type="text" width="10" name="class" value="<?php echo $class;?>" /></td>


<td>Year</td>
<td><input type="number" name="year" value="<?php echo $date;?>" /></td>

<td><input type="submit" name="submit" value="Search" /></td>

这是echo脚本

<?php
while(!empty($q) and $res=mysql_fetch_array($q)){   
?>
<tr>
    <td width="15%"><?php echo $res['fname'];?></td>
    <td width="8%"><?php echo $res['class'];?></td>
     <td width="10%"><?php echo $res['boarding_setting']- $res['boarding'];?></td>
     <td width="10%"><?php echo $res['exampaper_setting']- $res['exam_paper'];?></td>
     <td width="8%"><?php echo $res['fee_setting']- $res['school_fee'];?></td>
     <td width="10%"><?php echo $res['lunch_setting']- $res['lunch'];?></td>
    <td width="10%" style="border-width:medium"><?php echo $res['date'];?></td>
</tr>

<?php }?>

Answer 1

不是100％当然这甚至会起作用。如果我是你，我会开始考虑使用MYSQLI，因为你正在使用弃用的代码。 http://www.php.net/manual/en/mysqli.quickstart.dual-interface.php

<?php include("../Connections/conn.php")?>                       
<?php

$fname=$_POST['fname'];
$date=$_POST['year'];
$class=$_POST['class'];

if(isset($_POST['submit'])){



 $sql2="SELECT SUM(boarding)as boarding,SUM(exam_paper)as 
 exam_paper,SUM(school_fee)as  
 school_fee,SUM(lunch)as lunch,SUM(trans_fee) as   
 trans_fee,idnumber,fname,class,section,boarding,term,date,year FROM payment
 WHERE YEAR(date) = '$date' AND fname like '%".$fname."%' AND class like 
'%".$class."%' AND    
 date like '%".$date."%' UNION  
 SELECT(boarding_setting,exampaper_setting,fee_setting,lunch_setting,
 trans_setting,year,date   
  ) 
FROM setting WHERE YEAR(date) = '$date' AND fname like '%".$fname."%' AND class 
like  '%".$class."%' AND date like '%".$date."%'"; 

$q=mysql_query($sql2);  

  }
else{
$sql="SELECT * FROM payment";
$q=mysql_query($sql);
  }
   ?>

Answer 2

据我所知，UNION必须在两个SELECTS中提取相同数量的字段，第一个查询有10个字段，第二个查询有7个字段。

您的脚本是否会产生任何错误？

我同意Binary101010您正在使用已弃用的代码并且它易受SQL注入攻击，至少在您从用户那里获得的输入上使用mysql_real_escape_string。

为什么这个脚本不会产生结果

2 个答案: