php - 我的 id=x 只是显示所有内容？

Question

终于学会了但问题是当我点击 lol.php?id=2 它仍然显示所有内容来源:

<?php

   mysql_connect("localhost", "root", "");
   mysql_select_db("blog");

   $result = mysql_query("SELECT post_id, title, body FROM posts ORDER BY post_id DESC");

   while ($row = mysql_fetch_array($result)){
      $jokeid = $row["post_id"];
      $title = $row["title"];
      $body = $row["body"];
      echo("<A HREF='lol.php?view=$jokeid'>$title</A>". "<br />". $body . "<br />");
   }
   mysql_close();
?>

以及任何安全建议，我应该在哪里应用 mysql_reall_escape_string？

Answer 1

你没有任何用户输入的处理程序，尝试像下面这样的东西，它会检查是否首先设置了 id=NUMBER

<?php

mysql_connect("localhost", "root", "");
mysql_select_db("blog");
if ($_GET['id']) {
   $result = mysql_query("SELECT  title, body FROM posts WHERE post_id = ".intval($_GET['id']));
   $post = mysql_fetch_assoc($result);
   // use $post to show whatever you want here
}
else{
   $result = mysql_query("SELECT post_id, title, body FROM posts ORDER BY post_id DESC");

   while ($row = mysql_fetch_array($result)){
     $jokeid = $row["post_id"];
     $title = $row["title"];
     $body = $row["body"];
     echo("<A HREF='lol.php?view=".$jokeid."'>".$title."</A>". "<br />". $body . "<br />");
   }
}
mysql_close();