javascript - Ajax PHP 查询根据日期检索数据

Question

我正在尝试使用 Ajax 和 PHP 通过下拉列表检索数据。选择选项值与数据库列名配对时工作正常，但当我将其更改为特定于日期时，它不起作用。请仔细阅读下面的代码并提出所需的更改建议。

HTML:

<form>
<select name="users" onchange="showUser(this.value)">
  <option value="">Select a person:</option>
  <option value="1">July</option> // I doesn't work if when I change the value to "\'2015-07-01\' AND \'2015-07-31\'"
  <option value="2">August</option> // I doesn't work if when I change the value to "\'2015-08-01\' AND \'2015-08-31\'"
  <option value="3">September</option> // I doesn't work if when I change the value to "\'2015-09-01\' AND \'2015-09-30\'"
  <option value="4">October</option> // I doesn't work if when I change the value to "\'2015-10-01\' AND \'2015-10-31\'"
  </select>
</form>
<br>
<div id="txtHint"><b>Person info will be listed here...</b></div>

Javascript

function showUser(str) {
    if (str == "") {
        document.getElementById("txtHint").innerHTML = "";
        return;
    } else { 
        if (window.XMLHttpRequest) {
            // code for IE7+, Firefox, Chrome, Opera, Safari
            xmlhttp = new XMLHttpRequest();
        } else {
            // code for IE6, IE5
            xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
        }
        xmlhttp.onreadystatechange = function() {
            if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
                document.getElementById("txtHint").innerHTML = xmlhttp.responseText;
            }
        }
        xmlhttp.open("GET","getleads.php?q="+str,true);
        xmlhttp.send();
    }
}

PHP:

<?php
$q = intval($_GET['q']);

/*Comments Start, I even tried if else with the select values being only numeric 
if($q==1)
{
$q == "\'2015-07-01\' AND \'2015-07-31\'";
} 
elseif ($q==2)
{
$q == "\'2015-08-01\' AND \'2015-08-31\'";
} 
elseif ($q==3)
{
$q == "\'2015-09-01\' AND \'2015-09-30\'";
}
} elseif ($q==4){
$q == "\'2015-10-01\' AND \'2015-10-31\'";
} else ($q== )
{
$q == "*";
}    
Comments End*/

$con = mysqli_connect('localhost','user','password','database');
if (!$con) {
    die('Could not connect: ' . mysqli_error($con));
}

mysqli_select_db($con,"ajax_demo");
$sql="SELECT * FROM table WHERE ID = '".$q."'";
$result = mysqli_query($con,$sql);

echo "<table>
<tr>
<th>Name</th>
<th>Number</th>
<th>Email</th>


</tr>";
while($row = mysqli_fetch_array($result)) {
    echo "<tr>";
    echo "<td>" . $row['frm_name'] . "</td>";
    echo "<td>" . $row['frm_mobile'] . "</td>";
    echo "<td>" . $row['frm_email'] . "</td>";

    echo "</tr>";
}
echo "</table>";
mysqli_close($con);
?>

我什至尝试删除日期中的反斜杠。请帮忙!!

Answer 1

你不应该在你的sql查询中注入(inject)变量；现在，当您在服务器端对字符串进行硬编码时，这并不重要，但是如果您更改格式以接受表单中的值，则您将打开查询以进行 SQL 注入(inject)。

您应该使用准备好的语句；那么您不需要任何引号，并且如果您将来更改任何内容，也不会意外添加任何错误。

除此之外，您生成的 sql 是错误的，请检查取消注释字符串分配时会发生什么:

SELECT * FROM table WHERE ID = ''2015-07-01' AND '2015-07-31''

两个引号都错误，AND 语法也错误。这是假设 table 不是您真实的表名称。

你可能想要这样的东西:

SELECT * FROM your_table WHERE your_date_field BETWEEN ? AND ?

您可以将任何有效的格式化日期绑定(bind)到问号。

注意mysql还有一个MONTH()在这种特定情况下，该函数将使您的查询变得更加容易。