Question

为了降低sql注入的风险，我决定只使用预设下拉菜单让用户查询数据库。我有一组五个下拉列表与单个提交按钮一起工作很好，它打开它应该的页面，但我没有得到任何数据。我想我已经尝试了所有我能找到的东西，我怀疑这是错误的选择线，但我已经尝试了几十种变化而没有成功。似乎每个教程都显示了不同的内容，而且我发现的任何内容都没有帮助。我正在使用的下拉是：

<form action="test_result3.php" method="post">

    <?php

mysql_connect('localhost', 'user', 'password');
mysql_select_db('database');



    $sql = "SELECT DISTINCT Country FROM engravers Where Country <>'' AND Country IS NOT NULL ORDER by Country";
    $result = mysql_query($sql);

    echo "<select name\\='Country'>";
    echo "<option value='$_POST'>Country</option>";
    while ($row = mysql_fetch_array($result)) {
    echo "<option value='" . $row['Country'] . "'>" . $row['Country'] . "</option>";
    }
    echo "</select>";

    $sql = "SELECT DISTINCT Year FROM engravers Where Year <>'' AND Year IS NOT NULL ORDER by Year";
    $result = mysql_query($sql);

    echo "<select name\\='Year'>";
    echo "<option value='$_POST'>Year</option>";
    while ($row = mysql_fetch_array($result)) {
    echo "<option value='" . $row['Year'] . "'>" . $row['Year'] . "</option>";
    }
    echo "</select>";

    $sql = "SELECT DISTINCT Engraver1Surname FROM engravers Where Engraver1Surname <> '' AND Engraver1Surname IS NOT NULL ORDER by Engraver1Surname";
    $result = mysql_query($sql);

      echo "<select name\\='Engraver1Surname'>";
      echo "<option value='$_POST'>Engraver</option>";
      while ($row = mysql_fetch_array($result)) {
      echo "<option value='" . $row['Engraver1Surname'] . "'>" . $row['Engraver1Surname'] . "</option>";
      }
      echo "</select>";

      $sql = "SELECT DISTINCT Designer1Surname FROM engravers Where Designer1Surname <>'' AND Designer1Surname IS NOT NULL ORDER by Designer1Surname";
      $result = mysql_query($sql);

      echo "<select name\\='Designer1Surname'>";
      echo "<option value='$_POST'>Designer</option>";
      while ($row = mysql_fetch_array($result)) {
      echo "<option value='" . $row['Designer1Surname'] . "'>" . $row['Designer1Surname'] . "</option>";
      }
      echo "</select>";

     $sql = "SELECT DISTINCT Printer FROM engravers Where Printer <>'' AND Printer IS NOT NULL ORDER by Printer";
      $result = mysql_query($sql);

      echo "<select name\\='Printer'>";
      echo "<option value='$_POST'>Printer</option>";
      while ($row = mysql_fetch_array($result)) {
      echo "<option value='" . $row['Printer'] . "'>" . $row['Printer'] . "</option>";
      }
      echo "</select>";

          ?>

            <input type="submit" />   
        </form>

这会将我带到php页面test_results3，但它是空白的。

<?php

 mysql_connect('localhost', 'user', 'password') or die(mysql_error()); 
 mysql_select_db("database") or die(mysql_error()); 


 $query=("SELECT * FROM engravers WHERE $Country = $_POST['Country']", $Year = $_POST['Year'], $Engraver1Surname = $_POST['Engraver1Surname'], $Designer1Surname = $_POST['Designer1Surname]', $Printer = $_POST['Printer']);

while($result = mysql_fetch_array( $query ));

$num=mysql_numrows($result);
$i=0;
while ($i,$num){
$i++;
}

{ 
echo   $result['Country']; 
echo " "; 
echo  $result['Year']; 
echo "  Engraver: "; 
echo  $result['Engraver1Surname']; 
echo "  Designer: "; 
echo  $result['Designer1Surname']; 
echo "  Printer: "; 
echo  $result['Printer']; 
echo " "; 
$img_url = "http://www.engravedstamps.net/images/"; 
   { 
    echo '<img src="'.$img_url.$result['Images'].'" />'; 
   } 

   echo "<br>"; 

   echo "<br>"; 
   } 

$anymatches=mysql_num_rows($data); 
if ($anymatches == 0) 
{ 
echo "Sorry, but we can not find an entry to match your query<br><br>"; 
} 

echo "<b>Searched For:</b> " .$find; 
} 
mysql_close();
?>
    I seem to be getting more confused and frustrated by the hour with this. So far I've spent six weeks trying to write a three page search and display website and I don't feel like I'm any closer than when I started. Any help at all would be greatly appreciated.

如何从多个下拉菜单中获取结果？

0 个答案: