Question

我需要使用正确的酒店ID获取酒店，当用户选择酒店并显示错误的酒店信息时，下面的代码有一些错误。

这里附有错误网址： Error url

if(isset($_REQUEST["result"]))
{
$search = $_REQUEST["result"];
$checkin = $_REQUEST["checkin"];
$checkout = $_REQUEST["checkout"];
$guest = $_REQUEST["guest"];

$query = "select * from hotel,room_type WHERE hotel.hotel_id = room_type.hotel_id and hotel.hotel_address LIKE '%".$search."%' or hotel.hotel_city LIKE '%".$search."%' or hotel.hotel_state LIKE '%".$search."%' or hotel.hotel_name LIKE '%".$search."%' AND room_type.room_available_from >='$checkin' AND room_type.room_available_till <='$checkout' AND room_type.room_guest = '$guest' group by hotel.hotel_id";
$result = mysqli_query($conn,$query);

}

下面是显示酒店列表的代码，它显示的是同一个hotel_id：

<?php
    while($row = mysqli_fetch_array($result))
    {
       $hid = $row["hotel_id"];
       $url = 'hid='.$row["hotel_id"].'&checkin='.$checkin.'&checkout='.$checkout.'';
                ?>
       <div class="list-body" onclick="window.location.href='hotel.php?<?php echo $url ?>'">
                    <div class="col-photo">
                        <?php
                        $img_result = mysqli_query($conn,"SELECT * FROM hotel_images where hotel_id = $hid");
                        $r = mysqli_fetch_assoc($img_result);
                        ?>
                        <img src="../img/hotel/<?php echo $r["hotel_image"]?>">
      </div>
      <div class="col-info">
            <div class="info-content">
            <div class="col-title">
                  <h3><?php echo $row["hotel_name"] ?></h3>
      </div>

Answer 1

问题在于你的SQL。

select DISTINCT hotel.hotel_id, * from hotel
inner join room_type on room_type.hotel_id = hotel.hotel_id
where (hotel.hotel_address LIKE '%".$search."%'
or hotel.hotel_city LIKE '%".$search."%'
or hotel.hotel_state LIKE '%".$search."%'
or hotel.hotel_name LIKE '%".$search."%')
AND room_type.room_available_from >='$checkin'
AND room_type.room_available_till <='$checkout'
AND room_type.room_guest = '$guest'

另外两件事，是：

你不应该在循环内部执行sql查询（$ img_result应该在循环之外）因为它们性能很重（db变成了瓶子.neck）
你的sql容易受到sql注入攻击。你应该使用预备语句（PDO）或类似技术或至少过滤用户输入

Php获取错误的ID

1 个答案: