Question

我搜索过许多网站并尝试了在线提供的不同方式，但它看起来无法工作。单击next，last，first，previous时，它不会加载信息。它只加载第一页的结果。请帮忙！提前谢谢。

function retrieveName($fieldName)
{   
    $i=1;
    if(isset($_GET[$fieldName]))
    {
        mysql_connect("localhost", "root") or die(mysql_error());           
        mysql_select_db("intern") or die(mysql_error()); 


         //This checks to see if there is a page number. If not, it will set it to page 1 

         if (!(isset($pagenum))) 

         { 

         $pagenum = 1; 

         } 

         //Here we count the number of results 

         $intern = $_GET[$fieldName];
         $data = mysql_query("SELECT p.`internName`, p.`internNRIC`, c.`internSchName` FROM `personaldetails` p, `currentinstitution` c WHERE c.`internNRIC`= p.`internNRIC` AND p.`internName` like '%$intern%' || p.`internNRIC` like '%$intern%' || c.`internSchName` like '%$intern%' GROUP BY p.internNRIC") or die(mysql_error()); 

         $rows = mysql_num_rows($data); 

         //This is the number of results displayed per page 

         $page_rows = 1;            


         //This tells us the page number of our last page 

         $last = ceil($rows/$page_rows); 

         //this makes sure the page number isn't below one, or more than our maximum pages 

         if ($pagenum < 1) 

         { 

         $pagenum = 1; 

         } 

         elseif ($pagenum > $last) 

         { 

         $pagenum = $last; 

         } 

         //This sets the range to display in our query 

         $max = 'LIMIT ' .($pagenum - 1) * $page_rows .',' .$page_rows; 

    PRODUCTION.   //This is your query again, the same one... the only difference is we add $max into it

         $data_p = mysql_query("SELECT p.`internName`, p.`internNRIC`, c.`internSchName` FROM `personaldetails` p, `currentinstitution` c WHERE c.`internNRIC`= p.`internNRIC` AND p.`internName` like '%$intern%' || p.`internNRIC` like '%$intern%' || c.`internSchName` like '%$intern%' GROUP BY p.internNRIC $max ") or die(mysql_error()); 


         //This is where you display your query results

         while($row = mysql_fetch_array( $data_p )) 
         {      
            echo $i. ".";
            echo " NRIC : <a href='InternInfo.php?id='" . $row['internNRIC'] . ">".$row['internNRIC'] ."</a>";
            echo "</br><br/>";
            echo "  Name : ". $row['internName'] . "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name of School :" . $row['internSchName'];
            echo "</br><br/>";              
            $i++;                       
         } 

         echo "<p>";


         // This shows the user what page they are on, and the total number of pages

         echo " --Page $pagenum of $last-- <p>";


         // First we check if we are on page one. If we are then we don't need a link to the previous page or the first page so we do nothing. If we aren't then we generate links to the first page, and to the previous page.

         if ($pagenum == 1) 

         {

         } 

         else 

         {
            echo " <a href='{$_SERVER['PHP_SELF']}?pagenum=1&searchIntern=$intern'> <<-First</a> ";             
            echo "---Interns Search---";            
            $previous = $pagenum-1;         
            echo " <a href='{$_SERVER['PHP_SELF']}?pagenum=$previous&searchIntern=$intern'> <-Previous</a> ";           

         } 

         //This does the same as above, only checking if we are on the last page, and then generating the Next and Last links

         if ($pagenum == $last) 

         {

         } 

         else
         {          
            $next = $pagenum+1;             
            echo " <a href='{$_SERVER['PHP_SELF']}?pagenum=$next&searchIntern=$intern'>Next -></a> ";           
            echo "---Interns Search---";            
            echo " <a href='{$_SERVER['PHP_SELF']}?pagenum=$last&searchIntern=$intern'>Last ->></a> ";

         } 
    }else echo "Please enter your search.";
}

Answer 1

这不是100％，但是当您想要使用参数（好主意）或全局变量（例如$pagenum）时，看起来您正在使用$_GET['pagenum']的局部变量。你也让自己开放SQL注入。对需要在查询中使用的所有变量使用mysql_real_escape_string（例如 $ intern ）。

Answer 2

正如@cwallenpoole所说，看起来$pagenum的范围是在函数之外，我猜这个函数是在register_globals打开的情况下编写的，通常是a very bad thing 。我已经看到，在将旧的（继承的）站点移动到新服务器时会导致很多问题。

要解决该特定问题，请替换：

     if (!(isset($pagenum))) 

     { 

     $pagenum = 1; 

     }

用这个：

$pagenum = isset($_REQUEST['pagenum']) ?
    (int)$_REQUEST['pagenum'] :
    1;

这会将$pagenum设置为请求的pagenum值，如果页码不在请求中，则默认为1。它还将值转换为int，这至少应该停止一个注入攻击向量。功能的其余部分是另一回事......

PHP分页问题

2 个答案: