【发布时间】：2013-03-27 18:40:44
【问题描述】：
我的 PHP/MySQL 搜索有些困难。一年前它工作得很好，但由于某种原因它刚刚停止工作。我已经尝试过搜索，但无法弄清楚。我让它回显我的查询，但它从未添加到 WHERE 子句中。非常感谢任何帮助。
表格代码：
<form name="search" method="post">
<p><b>Name of Property:</b> <input type="text" id="NameSrch" name="NameSrch" /> (optional)</p>
<p><b>City Your Looking to Stay In:</b> <input type="text" id="CitySrch" name="CitySrch" /> (optional)</p>
<p><b>Listing ID Number:</b> <input type="text" id="RentalIDSrch" name="RentalIDSrch" /> (optional)</p>
<p><b>Number of Bedrooms:</b> <input type="text" id="BedroomSrch" name="BedroomSrch" /> (optional)</p>
<p><b>Number of Bathrooms:</b> <input type="text" id="BathroomSrch" name="BathroomSrch" /> (optional)</p>
<p><b>Maximum Occupancy:</b> <input type="text" id="SleepsSrch" name="SleepsSrch" /> (optional)</p>
<input type="hidden" name="method" value="exSearch">
<p><input type="submit" value="Search" /></p>
</form>
PHP 代码：
<?
$method = $_POST['method'];
if($method == 'exSearch') {
// Start Results Display
$con = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql: ' . mysql_error());
mysql_select_db($dbname);
$query_string = 'SELECT * FROM TABLE ';
$location_result_string = "";
$location_count = 0;
if ($NameSrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propName) LIKE ("%$NameSrch%") ';
}
if ($CitySrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propCity) LIKE ("%$CitySrch%") ';
}
if ($RentalIDSrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propID) LIKE ("%$RentalIDSrch%") ';
}
if ($BedroomSrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propBedrooms) LIKE ("%$BedroomSrch%") ';
}
if ($BathroomSrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propBaths) LIKE ("%$BathroomSrch%") ';
}
if ($SleepsSrch) {
if ($location_count > 0) {
$location_result_string = $location_result_string . " AND ";
}
$location_count = $location_count + 1;
$location_result_string = $location_result_string . ' (propSleeps) LIKE ("%$SleepsSrch%") ';
}
if ($location_count > 0) {
$location_result_string = "WHERE (" . $location_result_string . ")";
$query_string = $query_string . $location_result_string;
}
$re = mysql_query($query_string, $con) or die (mysql_error());
$number_of_rows = mysql_num_rows($re);
// Loop through each item in the result set
for ($h = 0; $h < $number_of_rows; $h++)
{
$propID = mysql_result($re, $h, 'propID');
$propAvail = mysql_result($re, $h, 'propAvail');
$propPets = mysql_result($re, $h, 'propPets');
$propName = mysql_result($re, $h, 'propName');
$propPropertyType = mysql_result($re, $h, 'propPropertyType');
$propPriceRange = mysql_result($re, $h, 'propPriceRange');
$propBedrooms = mysql_result($re, $h, 'propBedrooms');
$propBaths = mysql_result($re, $h, 'propBaths');
$propPropertyType = mysql_result($re, $h, 'propPropertyType');
$propSleeps = mysql_result($re, $h, 'propSleeps');
$propPic1 = mysql_result($re, $h, 'propPic1');
$propPicDesc1 = mysql_result($re, $h, 'propPicDesc1');
$nameLen = strlen($propName);
$petsLen = strlen($propPets);
$pets = $propPets;
//Results go here
}
echo $query_string;
}
// End Results Display
?>
【问题讨论】：
-
$NameSrch, $CitySrch等变量是怎么设置的？它们是完全设置还是您希望它们通过 POST 设置？因为那行不通。您可以通过 $_POST['fieldName'] 访问发布的内容。此外，访问字符串中的变量，例如：'blablabla'.$sName.'额外的';或者如果你使用双引号，你可以像 "blablabla {$sName} extra" 那样做。 -
这可能是问题所在。如果您有设置
REGISTER_GLOBALS=ON，则此代码可以使用，但使用REGISTER_GLOBALS=OFF（应该如此），您必须通过$_POST访问变量 -
如果像
$NameSrch这样的变量直接取自用户输入，那么你的脚本很可能容易受到SQL注入的攻击。