我正在尝试建立一个OPAC网站。一切正常，因为它主要是从数据库中选择并显示它。我注意到当我尝试搜索的书名带有撇号时，它什么也不显示。如果书名不包含任何单引号，则所有内容均适用。我的数据库使用mysql。
<!-- {this is how i connect my datatbase} -->
<?php
include 'includes/dbh.inc.php';
?>
<!DOCTYPE <!DOCTYPE html>
<html>
<head>
<title></title>
<link rel="stylesheet" type="text/css" href="stylesheet.css">
</head>
<body>
<div id= "wrapper">
<a href = "index.php"><img class="cpclogo" src="cpc.png"></a>
<header>
<h1 class="CPC"> Colegio de la Purisima Concepcion </h1>
<h3 class="Saying"> The School of the Archdiocese of Capiz </h3>
</header>
</div>
header.php文件
<?php
$dbServername = "localhost";
$dbUsername = "root";
$dbPassword = "";
$dbName = "library";
$conn = mysqli_connect($dbServername, $dbUsername, $dbPassword, $dbName);
?>
search.php文件
<?php
include 'header.php'
?>
<h1 class="searchresults">Search Results:</h1>
<div class="search-container">
<?php
if (isset($_POST['submit']))
{
$search = mysqli_real_escape_string($conn, $_POST['search']);
$sql = "SELECT * FROM book WHERE Book_Title LIKE '%$search%' OR Author LIKE '%$search%' OR Call_Number LIKE '%$search%' OR Book_ID LIKE '%$search%'";
$result = mysqli_query($conn, $sql);
$queryResult = mysqli_num_rows($result);
$search = mysqli_real_escape_string($conn, $_POST['search']);
echo "<h3 class='resultcount'>There are ".$queryResult." results!</h3>";
if ($queryResult > 0)
{
while ($row = mysqli_fetch_assoc($result))
{
echo "<a href='article.php?Book_Title=".$row['Book_Title']."&id=".$row['Book_ID']."&call=".$row['Call_Number']."' class= 'search-ref'><div class=search-box>
<tr><td>".$row['Book_Title']." </td>
<td>/ ".$row['Author']."</td>
<p>".$row['Call_Number']."</p>
</div></tr><br>";
}
}
}
?>
<input class="backbtn" type="button" value="Back" onclick="history.back(-1)" />
</div>
article.php文件
<?php
include 'header.php';
?>
<div class="article-container">
<?php
//Declairing Variables
$Author = "Authors: ";
$Edition = "Edition: ";
$Subject ="Subject: ";
$Summary = "Summary: ";
$Notes = "Notes: ";
$Publisher ="Publisher: ";
$Phys_Desc ="Physical Description: ";
$Call_Number ="Call Number: ";
$Book_ID = "Book ID: ";
$Title= mysqli_real_escape_string($conn, $_GET['Book_Title']);
$sql ="SELECT * FROM book WHERE Book_Title='$Title'";
$result = mysqli_query($conn, $sql);
$queryResult = mysqli_num_rows($result);
if ($queryResult > 0)
while ($row = mysqli_fetch_assoc($result))
{
echo "<div class= 'article-box'>
<h3 class='booktitle'><b>".$row['Book_Title']."</h3></b>
<p><b>$Author</b>".$row['Author']."</p>
<p><b>$Edition</b>".$row['Edition']."</p>
<p><b>$Subject</b>".$row['Subject']."</p>
<p><b>$Summary</b>".$row['Summary']."</p>
<p><b>$Notes</b>".$row['Notes']."</p>
<p><b>$Publisher</b>".$row['Publisher']."</p>
<p><b>$Phys_Desc</b>".$row['Phys_Desc']."</p>
<p><b>$Call_Number</b>".$row['Call_Number']."</p>
</div>";
}
?>
<div class="btns">
<input class="backbtn" type="button" value="Back" onclick="history.back(-1)" />
<button type="submit" id="copybtn" class= "copybtn">Copies</button>
</div>
<!-- POP-UP WINDOW -->
<div class="bg-modal">
<div class="modal-content">
<div class="close"></div>
<table class = "table">
<tr>
<th>Copy</th>
<th>Status</th>
<th>Accession Number</th>
<th>Call Number</th>
<th>Location</th>
<th>Format</th>
<th>Cost</th>
<th>Vendor</th>
<th>Fund</th>
<th>Date Acquired</th>
</tr>
<?php
$id = mysqli_real_escape_string($conn, $_GET['id']);
$call = mysqli_real_escape_string($conn, $_GET['call']);
$sql = "SELECT Copy, Status, Accession_Number, l.Location, f.Format, Cost, Vendor, u.Fund, Date_Acq
FROM copy c
INNER JOIN location l ON l.Location_Acronym = c.Location
INNER JOIN format f ON f.Format_ID = c.Format
INNER JOIN fund u ON u.Fund_ID = c.Fund
WHERE Book_ID='$id'";
$result = mysqli_query($conn, $sql);
$queryResult = mysqli_num_rows($result);
if ($queryResult > 0)
{
while ($row = mysqli_fetch_assoc($result))
{
echo "
<tr><td>".$row['Copy']."</td>
<td>".$row['Status']."</td>
<td>".$row['Accession_Number']."</td>
<td>".$call."</td>
<td>".$row['Location']."</td>
<td>".$row['Format']."</td>
<td>₱".$row['Cost']."</td>
<td>".$row['Vendor']."</td>
<td>".$row['Fund']."</td>
<td>".$row['Date_Acq']."</td></tr>
";
}
}
?>
</table>
</div>
</div>
<script src="popup.js"></script>
</body>
</html>
copies.php文件
<?php
include 'header.php'
?>
<h1 class="copyresults">Copy Results:</h1>
<div class="article-container">
<table class = "table">
<tr>
<th>Barcode</th>
<th>Copy</th>
<th>Status</th>
<th>Location</th>
<th>Format</th>
<th>Vendor</th>
</tr>
<?php
{
$id = mysqli_real_escape_string($conn, $_GET['id']);
$sql = "SELECT * FROM copy WHERE Book_ID='$id'";
$result = mysqli_query($conn, $sql);
$queryResult = mysqli_num_rows($result);
if ($queryResult > 0)
{
while ($row = mysqli_fetch_assoc($result))
{
echo "
<tr><td>".$row['Barcode']."</td>
<td>".$row['Copy']."</td>
<td>".$row['Status']."</td>
<td>".$row['Location']."</td>
<td>".$row['Format']."</td>
<td>".$row['Vendor']."</td></tr>
";
}
}
}
?>
</table>
答案 0 :(得分：1)
我认为这有点可疑：
echo "<a href='article.php?Book_Title=".$row['Book_Title']."&id=".$row['Book_ID']."&call=".$row['Call_Number']."' class= 'search-ref'><div class=search-box>...
看到您的href值用单引号引起来了吗？当您单击该链接时，整个查询字符串将在第一个单引号处被截断，这可能是罪魁祸首。
在urlencode()上使用$row['Book_Title']，如果它是唯一的麻烦制造者。
echo "<a href='article.php?Book_Title=" . urlencode($row['Book_Title']) . "&id=" . $row['Book_ID'] . "&call=".$row['Call_Number'] . "' class= 'search-ref'><div class=search-box>...
否则这可能会使您的代码更具吸引力（肯定更健壮）：
$data = [
'Book_Title' => $row['Book_Title'],
'id' => $row['Book_ID'],
'call' => $row['Call_Number']
];
echo "<a href='article.php?" . http_build_query($data) . "' class='search-ref'><div class=search-box>...