Question

我似乎无法在$ _GET数组上返回任何值。

例如，它工作正常 $sql = "SELECT * FROM review WHERE brand='brandx'" 但是当我在第5行将其更改为 brand='$id' 时，没有任何内容传递。

我的index.php中的fetch数组运行得很好但是当它变为brand.php的href时（如下所示），我丢失了我的弹珠。

<?php
if(isset($_GET["id"])){
include "php_includes/db_conx.php";
$id = preg_replace('#[^0-9]#i', '', $_GET["id"]);
$sql = "SELECT * FROM review WHERE brand='$id'";
$query = mysqli_query($db_conx, $sql);
$productList = ""; 
// Now make sure that brand exists in the table
$productCount = mysqli_num_rows($query);// count the output amount
if($productCount > 0){
//get the products off the selected brand
while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC)){
$username = $row['username'];
$productname = $row['productname'];
$comment = $row['comment'];
$rating = $row['rating'];
$date = $row['date'];
$productList .= 
'
<div class="wrapper">
  <div class="brand-and-name">
    <div class="brand">
        <a href="brand.php?id='.$id.'">
        <span>'.$id.'</span>
        </a>
    </div>
    <div class="prod-name">
        <a href="product.php">'.$productname.'</a>
    </div>
  </div>
  <div class="prod-container" id="pd1">
        <div class="prod-img"><img     src="https://giovanniphotography.files.wordpress.com/2011/09/creativemevid19.jpg" /></div>
        <div class="comment">
            <a href="#"><b>My Score: '.$rating.'/10</b></a>
            <br /><br />
            <p>'.$comment.'</p>
        </div>
        <div class="profile">
            <div class="profile-thumb" id="pt1"></div>
            <div class="name" id="nm1">
                <a href="user.php?user='.$username.'">'.$username.'</a><br />'.$date.'
            </div>
        </div>
        <div class="social-share-1">
            <div class="like-btn"></div>
            <div class="comment-btn"></div>
            <div class="wishlist-btn">+ wishlist</div>
        </div>
  </div><!--end .prod-container#pd1-->
</div><!--wrPer-->
';
}
    }else{
    echo "Product doesnt exist";
    exit ();
    }
}else{
echo "You got to pick a brand man!";
exit ();
}
?>

Answer 1

在preg_replace之后，此代码是否有效？如果没有，你可能没有在php.ini中启用魔术引号。我注意到在你的输出的其余部分你是连接字符串和变量。

print "ID: $id";

Answer 2

使用预先准备好的声明，不要轻易消除用户输入：

if($stmt = $db_conx->prepare("SELECT username, productname, comment, rating, date FROM review WHERE brand=?)")
{
    $stmt->bind_value('s', $_GET["id"]);
    $result = $stmt-execute();

    $stmt->bind_result($username, $productname, $comment, $rating, $date ); //bind result to vars
    //now you can loop through your result:
    while($stmt->fetch()) {
        //use $username, $productname, $comment, $rating, $date etc to work with your values
    }
}

$ _GET数组的变量不返回任何值

2 个答案: