Question

第二次大家好。

我最近问了一个关于清理一些我做过的丑陋代码的问题并得到了我很快就要求的帮助。感谢那！

原始问题主题在这里：PHP - Search database and return results on the same page

我很快被指示在mysqli中使用预处理语句而不是我为避免SQL注入等而做的事情。我知道这个建议会成为我的意思，所以这并不奇怪。所以我做了一些挖掘并相应地重写了原始代码。但现在我打破了形式。

有谁愿意看看我错过了什么？我是新手，我在互联网上的搜索并没有帮助我自己调试。

<!DOCTYPE html>
<html>
<head>
<title>Client Search Results</title>
<link rel="stylesheet" href="styles.css">
</head>

<body>

<div class="container">      
<form id="contact" action="" method="post">

<fieldset>
<h4>Search For Client</h4>
<input name="search" placeholder="Enter Name Here" type="text">
</fieldset>

<fieldset>
<button type="submit">Search</button>
</fieldset>

</form>
</div>

<div class='container'>    
<form id='contact' action='edit.php' method='post'>

<fieldset>
<h4>Search Results</h4>
<select size="5" style="width:100%" name='id' >

<?php
// Include database communication info
include("../../comm/com.php");

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Search
$search = "%{$_POST['search']}%";
$stmt = $db->prepare("SELECT client_id, firstname, lastname, city, state  FROM client WHERE firstname LIKE ?"); 
$stmt->bind_param("s", $search);
$stmt->execute();
$stmt->store_result();
$numRows = $stmt->num_rows;
$stmt->bind_result($client_id, $firstname, $lastname, $city, $state); 

if($result > 0) {
  while ($stmt->fetch()) {
    echo "<option value='$client_id'>$firstname $lastname - $city, $state</option>";
  }
}
$stmt->close();
?>

</select>
</fieldset>

<fieldset>
<button type='submit' name='submit'>View Selection</button>
</fieldset>

</form>
<div>

</body>
</html>

Answer 1

在多次重写此代码之后，在收到许多不同方向的帮助后，这是我确定的代码。像我想要的工作，似乎是坚实的。

<html>
<head>
<title>Client Search Results</title>
<link rel="stylesheet" href="styles.css">
</head>

<body>

<div class="container">      
<form id="contact" action="" method="post">

<fieldset>
<h4>Search For Client</h4>
<input name="search" placeholder="Enter Name Here" type="text" autofocus>
</fieldset>

<fieldset>
<button type="submit">Search</button>
</fieldset>

</form>
</div>

<div class='container'>    
<form id='contact' action='edit.php' method='post'>

<fieldset>
<h4>Search Results</h4>
<select size="5" style="width:100%" name='client_id' >

<?php

// Retrieve Search Term
if (isset($_POST['search'])) {
    $search = "%{$_POST['search']}%";
}

// Include Connection Credentials
include("../../comm/com.php");

//Connection to Database
$link = mysqli_connect($servername, $username, $password, $dbname);

// Connection Error Check
if ($link->connect_errno) {
    echo "Sorry, there seems to be a connection issue.";
    exit;
}

// Prepared Statement For Database Search
if ($stmt = $link->prepare("SELECT client_id, firstname, lastname, city, state FROM client WHERE firstname LIKE ? OR lastname LIKE ?")) {

// Bind Search Variable
    $stmt->bind_param('ss', $search, $search);

// Execute the Statement
    $stmt->execute();

// Bind Variables to Prepared Statement
    $stmt->bind_result($client_id, $firstname, $lastname, $city, $state);

// Fetch Values
    while ($stmt->fetch()) {

// Display Results of Search
        echo "<option value='$client_id'>$firstname $lastname - $city, $state</option>";
    }
}

// Close Statment
$stmt->close();

// Disconnect from Database 
mysqli_close($link);
?>

</select>
</fieldset>

<fieldset>
<button type='submit' name='submit'>View Selection</button>
</fieldset>

</form>
<div>
</body>
</html>

mysqli准备了声明搜索表单

1 个答案: