php - $_GET 不适用于 SQL 查询

Question

我尝试在 SQL 查询中同时使用 $_GET 和 $_POST。以下是我的代码:

<?php
    $assignment = mysql_real_escape_string($_GET['name']);
    echo "$assignment <br>";

    if (isset($_POST['add'])) { 

        $user = $_POST['username'];
        $text = $_POST['comment'];

        $query = "INSERT INTO comments (user, text, assignment) VALUES ('$user', '$text', '$assignment')";
            mysql_query($query) or die('Error, comment failed to post');
    } 
?>

<h1>Add Comment</h1> 
<form action="log_entry.php" method="post"> 
    Name:<br/> 
    <input type="text" name="username" value="" /> 
    <br /><br /> 
    Comment:<br /> 
    <textarea style="height:200px;" type="text" name="comment" value="" ></textarea> 
    <br /><br />
    <input type="submit" name="add" value="Add Comment" />
</form>

但是，$assignment 变量在查询中不起作用。在进行查询之前它会正确回显，但在 INSERT 完成后表内的值是空的。到底是什么原因造成的？

Answer 1

不要尝试组合 GET 和 POST，而是使用隐藏的输入字段:

<?php
    $assignment = mysql_real_escape_string($_POST['name']); // Name is now in POST data, so swap this
    echo "$assignment <br>";

    if (isset($_POST['add'])) { 

        $user = $_POST['username'];
        $text = $_POST['comment'];

        $query = "INSERT INTO comments (user, text, assignment) VALUES ('$user', '$text', '$assignment')";
            mysql_query($query) or die('Error, comment failed to post');
    } 
?>

<h1>Add Comment</h1> 
<form action="log_entry.php" method="post"> 
    <!-- Add hidden input to carry the name -->
    <input type="hidden" name="name" value="<?php echo $_GET['name']; ?>"/>
    <!-- Rest of the form is the same -->
    Name:<br/> 
    <input type="text" name="username" value="" /> 
    <br /><br /> 
    Comment:<br /> 
    <textarea style="height:200px;" type="text" name="comment" value="" ></textarea> 
    <br /><br />
    <input type="submit" name="add" value="Add Comment" />
</form>