Question

/这是我的代码，您认为我的代码中存在什么问题。部门不存在于我的表单中，所以我只给它一个值7.我想从departmentId调用，其中departmentId为7. $ res不执行所以它必须在我的查询中，请帮忙

$department = 7;
$depId   = "SELECT * FROM departments";

$query_dept         = mysql_query($depId, $conn);
$query_dept_results = mysql_fetch_array($query_dept);



if($query_dept_results['departmentId'] == $department) {
   $id    = $query_dept_results['departmentId'];      
   $query = "INSERT INTO suggestion (departmentId,name,address,barangay,message) VALUES('$id','$sfullname','$saddress','$sbarangay','$smessage')";
   $res = mysql_query($query);
  }
   if ($res) {
    $errTyp = "success";
    $errMSG = "Sending successfully";
    unset($sfullname);
    unset($saddress);
    unset($sbarangay);
    unset($smessage);
    header("Location:pupuntahan.php");
   } else {
    $errTyp = "danger";
    $errMSG = "Something went wrong, try again later..."; 
   }

Answer 1

你的查询需要where子句。所以像这样改变sql stament

$depId   = "SELECT * FROM departments where departmentId = '$department'";

它将返回其departmentId为7。

旁注： - security.database.sql-injection

我的查询无法完成我该怎么办？

1 个答案: