【发布时间】:2015-02-04 18:00:58
【问题描述】:
我认为我没有正确编写代码。有人可以看看这个吗?我是php新手!
<?php
// Create Connection
$connect = mysqli_connect('localhost','root','test123','joomla');
// Check Connection
if(mysqli_connect_errno($connect)) {
echo 'Failed to connect to DataBase| '. mysqli_connect_error();
}
?>
我在 url 参数中如果 rp_id 不存在的情况下添加了if(issets($_GET['rp_id'])) - 它只是关闭数据库
<?php
if(issets($_GET['rp_id]')) {
$rp_id = htmlspecialchars($_GET["rp_id"]);
// open record with evdet_id =$rp_id
$result = mysqli_query($connect,"SELECT * FROM n0dap_jevents_vevdetail WHERE evdet_id =".$rp_id);
while($row = mysqli_fetch_array($result)):
$value = $row['google_map'];
echo $value;
endwhile;
}
$connect->close();
//if the rp_id does exist the go ahead and run the top otherwise close it.
} else {
$connect->close();
}
?>
【问题讨论】:
-
您容易受到sql injection attacks 的攻击。 htmlspecialchars 不是对此的防御。