php - 传递的变量在目标页面的 url 中返回空

Question

我快要疯了。我试图将一个变量从显示所有相册缩略图和名称的页面传递到一个页面，该页面将使用传递的变量显示该画廊中的所有图片，但目标页面上的 url 中的变量为空。我在网上和这个网站上看到过类似的案例，我已经应用了这些建议，但仍然是一样的。这是列出缩略图并传递变量(id)的代码。

    <?php
            include ("config.php");
            $conn = mysqli_connect(DB_DSN,DB_USERNAME,DB_PASSWORD,dbname);
            $albums = mysqli_query($conn,"SELECT * FROM albums");
            if (mysqli_num_rows($albums) == 0) {
                echo "You have no album to display. Please upload an album using the form above to get started. ";
            }
            else{
                echo "Albums created so far:<br><br>";
                echo "<table rows = '4'><tr>";
                while ($thumb = mysqli_fetch_array($albums)) {
                    echo '<td><a href ="view.php?id="'.$thumb['id'].'"/><img src = "'.$thumb['thumbnail'].'"/><br>'.$thumb['album_name'].'<br>'.$thumb['id'].'</a></td>';
                }
                echo "</tr></table>";
            }
     ?>

获取传递的变量的代码如下:

<?php
include("config.php");
$conn = mysqli_connect(DB_DSN,DB_USERNAME,DB_PASSWORD);
$db = mysqli_select_db($conn,dbname);
if (isset($_GET['id'])) {
    $album_id = $_GET['id'];
    $pic = "SELECT * FROM photos WHERE album_id ='$album_id'";
    $picQuery = mysqli_query($conn,$pic);
    if (!$picQuery) {
        exit();
    }
    if (mysqli_num_rows($picQuery) == 0) {
        echo "Sorry, no Pictures to display for this album";
}
else{
    echo "Pictures in the gallery:<br><br>";
    while ($result = mysqli_fetch_assoc($picQuery)) {
            echo "<img src='".$result['photo_path']."'/>";
        }
    }
}
?>

请帮忙，因为我过去两天一直在努力解决问题。

Answer 1

首先，您的代码对于 sql 注入(inject)的抵抗力很弱:

$album_id = $_GET['id']; // here
$pic = "SELECT * FROM photos WHERE album_id ='$album_id'";

使用 $album_id = intval($_GET['id'])或准备好的语句功能。

其次，将调试行添加到代码中，例如:

<?php
include("config.php");
if (isset($_GET['id'])) {
    $album_id = intval($_GET['id']);
    var_dump($album_id); // should print actual passed id

    $conn = mysqli_connect(DB_DSN,DB_USERNAME,DB_PASSWORD);
    var_dump($conn _id); // should print conn resource value

    $db = mysqli_select_db($conn, dbname);
    var_dump($db); // should print 'true' if db select is ok

    $pic = "SELECT * FROM photos WHERE album_id ='$album_id'";
    $picQuery = mysqli_query($conn, $pic);
    var_dump($picQuery); // should print query resource value

    if (!$picQuery) {
        exit();
    }

    if (mysqli_num_rows($picQuery) == 0) {
        echo "Sorry, no Pictures to display for this album";
    } else {
        echo "Pictures in the gallery:<br><br>";
        while (($result = mysqli_fetch_assoc($picQuery)) !== false) {
            var_dump($result ); // should print fetched assoc array
            echo "<img src='".$result['photo_path']."'/>";
        }
    }
}

通知 $album_id = intval($_GET['id'])和while (($result = mysqli_fetch_assoc($picQuery)) !== false)零件

然后点击链接view.php?id=<existing-album-id>并观察调试结果。哪一步调试输出与预期不同 - 存在问题。