我正在使用GET方法从url中检索值,然后使用if语句确定它们是否存在,然后针对数据库查询它们以仅显示与它们匹配的项目,我的请求会出现未知错误。这是我的代码
$province = $_GET['province'];
$city = $_GET['city'];
if(isset($province) && isset($city) ) {
$results3 = mysql_query("SELECT *
FROM generalinfo
WHERE province = $province
AND city = $city ")
or die( "An unknown error occurred with your request");
} else {
$results3 = mysql_query("SELECT * FROM generalinfo");
} /*if statement ends*/
答案 0 :(得分:6)
在SQL中需要使用单引号括起字符串:
"SELECT * FROM generalinfo WHERE province='$province' AND city='$city'"
请注意,以这种方式构造查询可能会使您面临SQL注入漏洞的风险。请考虑使用mysql_real_escape_string代替。
"SELECT * FROM generalinfo WHERE province='" .
mysql_real_escape_string($province) . "' AND city='" .
mysql_real_escape_string($city) . "'"