没有得到 mysql db 数据 .... 用 php 进入 html 页面（难倒）答案

【问题标题】：Not get mysql db data .... into html page with php (stumped)没有得到 mysql db 数据 .... 用 php 进入 html 页面（难倒）
【发布时间】：2017-01-25 03:51:57
【问题描述】：

我正在处理一项作业，它要求我从 3aStudent_Slip.php 中选择一个“slip_id”并将其传递给 4aservice_request.php 并填充一个在 php 代码中构建的表。我没有任何 php 类，所以我真的很困惑为什么它没有从服务器上的“ProgrammingDatabase”获取任何数据库。

使用下面的代码...

<?php
    require_once('auth.php');
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Service Requests</title>
<link href="loginmodule.css" rel="stylesheet" type="text/css" />
</head>
<body>
    <div id="innerWrapper">
<h1>Service request by <?php echo $_SESSION['SESS_FIRST_NAME'];?></h1>

<a href="index.php">Login Page</a> | 
<a href="amenu.php">Menu Page</a> | 
<a href="logout.php">Logout</a>

<?php
$slip_id = strtoupper($_POST['slip_id']);
echo("<h2>Services for Slip ID $slip_id</h2>");

//Verify Password
$vlogin=$_SESSION['vlogin'];
$vpassword=$_SESSION['vpasswd'];

//Connection String
$con=mysql_connect("localhost", $vlogin, $vpasswd);

if(!$con)
{
    die("Could not connect".mysql_error());
}

//Select Database
mysql_select_db("ProgrammingDatabase", $con);

//The actual SQL code goes below into the structured variable $result
$result=mysql_query("SELECT * FROM service_request");

//Constructing the table and column names
echo "<table border='1'>
<tr>
<th>Service ID</th>
<th>Description</th>
</tr>";

//Looping until there are no more records from $result
//If there are records, print the column for that row
//do the while loop below with the variables from $result

while($row=mysql_fetch_array($result))
{
    echo "<tr>";
    echo "<td>".$row['service_id']."</td>";
    echo "<td>".$row['description']."</td>";
    echo "</tr>";
}

echo "</table>";

//Close the SQL connection string
mysql_close($con);

?>

<br />
<form action="a4Services_Student.php " method="post">
<br />
</form>
</div>
</body>
</html>

【问题讨论】：

Little Bobby 说your script is at risk for SQL Injection Attacks.。即使escaping the string 也不安全！
请stop using mysql_* functions。 These extensions 已在 PHP 7 中删除。了解PDO 和 MySQLi 的 prepared 语句并考虑使用 PDO，it's really pretty easy。
在打开<?php标签error_reporting(E_ALL); ini_set('display_errors', 1);后立即将错误报告添加到文件顶部

标签： php mysql html-table

【解决方案1】：

正如一些 cmets 已经声明的那样，您使用的功能不安全，并且也被贬值了。最好的方法是使用 PDO。我在这里有一个例子https://snippetbox.xyz/5c3db100112bca204643/

<?php 
    /** How to get information out a database securely **/

    $id = 6; // example value 
    //connect to mysql database using pdo
    $conn = new PDO('mysql:host=localhost;dbname=someDatabase', $username, $password);
    $query = "SELECT * FROM myTable WHERE id = :id";

    //prepare the statement to avoid sql injection
    $stmt = $conn->prepare($query);

    //load variable into the statement and execute
    $stmt->execute(array('id' => $id));

    //fetch the results
    $rows = $stmt->fetchAll(PDO::FETCH_OBJ);

    //loop through all the lines
    foreach ($rows as $row){
        //loop through results here

        //example
        //echo $row->value;
    }
?>

【讨论】：