php - 从下拉菜单中检索数据

Question

我创建了一个下拉菜单，但出了点问题。当我选择矩阵数字时，它似乎不保存数据。我在文本框中输入了一个值，例如 2012456824，然后数据就出来了，但是当我没有输入值时，数据也会出来。

这可能是什么原因造成的？

dropdownmenu.html

<form action="searchbook2.php" method="post">
          <font color=black>Search By : </font>
          <select name="choose">
               <option selected="selected">-Please Choose-</option>
               <option value="matricNo">Matric No.</option>
               <option value="bookAccession">Accession No.</option>
          </select>
          <input type="text" name="search">
          <input type="submit" name="submit" value="search" style="background:#996699"><br><br>
</form>

searchbook2.php

<?php
echo "<center><br><br>";

$choose = $_POST['choose'];
if($choose == 'matricNo'){
$search = $_POST['search'];
$sql = mysql_query("SELECT b.book_Accession, b.patron_ID, p.patron_Name, b.book_Title, b.book_Status

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.patron_ID = p.patron_ID
                    WHERE b.patron_ID LIKE '%$search%'");

if(mysql_num_rows($sql) > 0) {
 while($data = mysql_fetch_array($sql)) {
    $patron_ID = $data['patron_ID'];
    echo "<br><br><table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
    echo "<tr><td colspan=2 align=center bgcolor=gray>Loan Item</td></tr>";

    echo "<td width='200'>&nbsp;Patron Id : </td><td width='473'>".$data['patron_ID']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Accession : </td><td>".$data['book_Accession']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
    echo "</tr><tr>";
    echo '<td colspan="2" align=center><a href="bookDetail.php?patron_ID=' . $data['patron_ID'] . '"
    onClick="javascript:return confirm(\'Do you want see this information ?\')">Click Here</a></td>';
    echo "</tr>";
    echo "</table>";
    echo "<br><Br><br>";
 }
 }

}else if($choose == 'bookAccession'){
$search = $_POST['search'];
$sql = mysql_query("SELECT  b.book_Accession, b.patron_ID, p.patron_Name, b.ISBN, b.book_Title, b.book_Author, b.book_Status, b.book_Year,
                    b.book_Category 

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.book_Accession = p.book_Accession
                    WHERE b.book_Accession LIKE '%$search%'");

if(mysql_num_rows($sql) > 0) {
 while($data = mysql_fetch_array($sql)) {
    $book_Accession = $data['book_Accession'];

    echo "<table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
    echo "<tr><td colspan=2 align=center bgcolor=gray>Book Information</td></tr>";

    echo "<td width='200'>&nbsp;Accession No. : </td><td width='473'>".$data['book_Accession']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Id : </td><td>".$data['patron_ID']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Isbn : </td><td>".$data['ISBN']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Author : </td><td>".$data['book_Author']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Year : </td><td>".$data['book_Year']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Category : </td><td>".$data['book_Category']."</td>";

}
 echo "</table>";
 echo "<br><br>";
 }
 }
 else{
 echo "Sorry the data you have been search is not available";
 }
?>

Answer 1

我认为您的问题是您没有验证$_POST['search']。因此，如果它为空，您的查询将如下所示:WHERE b.patron_ID LIKE '%%'" 这将为您返回数据库中的所有记录。

if (!empty($search)) {
    //Show the table
} else {
    echo 'Plase provide a search condition!';
}

并使用 mysql_real_escape_string 转义字符串，如果您确实这样做以避免 SQL 注入(inject)，但最好使用 mysqli_* 函数或 PDO，因为 mysql_* 函数已被弃用。

更新:

给你。

<?php
echo "<center><br><br>";

$choose = $_POST['choose'];
if ($choose == 'matricNo') {
    $search = mysql_real_escape_string($_POST['search']);
    if (!empty($search)) { //<---- HERE IS A CHECK
        $sql = mysql_query("SELECT b.book_Accession, b.patron_ID, p.patron_Name, b.book_Title, b.book_Status
                    FROM book b
                    INNER JOIN patrons p 
                    ON b.patron_ID = p.patron_ID
                    WHERE b.patron_ID LIKE '%$search%'");

        if (mysql_num_rows($sql) > 0) {
            while ($data = mysql_fetch_array($sql)) {
                $patron_ID = $data['patron_ID'];
                echo "<br><br><table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
                echo "<tr><td colspan=2 align=center bgcolor=gray>Loan Item</td></tr>";

                echo "<td width='200'>&nbsp;Patron Id : </td><td width='473'>" . $data['patron_ID'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Name : </td><td>" . $data['patron_Name'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Accession : </td><td>" . $data['book_Accession'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Title : </td><td>" . $data['book_Title'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Status : </td><td>" . $data['book_Status'] . "</td>";
                echo "</tr><tr>";
                echo '<td colspan="2" align=center><a href="bookDetail.php?patron_ID=' . $data['patron_ID'] . '"
    onClick="javascript:return confirm(\'Do you want see this information ?\')">Click Here</a></td>';
                echo "</tr>";
                echo "</table>";
                echo "<br><Br><br>";
            }
        }
    } else {
        //This happens if no search criteria given
        echo "Please provide a search condition";
    }
} else if ($choose == 'bookAccession') {
    $search = mysql_real_escape_string($_POST['search']);
    if (!empty($search)) { //<---- HERE IS A CHECK
        $sql = mysql_query("SELECT  b.book_Accession, b.patron_ID, p.patron_Name, b.ISBN, b.book_Title, b.book_Author, b.book_Status, b.book_Year,
                    b.book_Category 

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.book_Accession = p.book_Accession
                    WHERE b.book_Accession LIKE '%$search%'");

        if (mysql_num_rows($sql) > 0) {
            while ($data = mysql_fetch_array($sql)) {
                $book_Accession = $data['book_Accession'];

                echo "<table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
                echo "<tr><td colspan=2 align=center bgcolor=gray>Book Information</td></tr>";

                echo "<td width='200'>&nbsp;Accession No. : </td><td width='473'>" . $data['book_Accession'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Id : </td><td>" . $data['patron_ID'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Name : </td><td>" . $data['patron_Name'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Isbn : </td><td>" . $data['ISBN'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Title : </td><td>" . $data['book_Title'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Author : </td><td>" . $data['book_Author'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Status : </td><td>" . $data['book_Status'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Year : </td><td>" . $data['book_Year'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Category : </td><td>" . $data['book_Category'] . "</td>";
            }
            echo "</table>";
            echo "<br><br>";
        }
    } else {
        //This happens if no search criteria given
        echo "Please provide a search condition";
    }
} else {
    echo "Sorry the data you have been search is not available";
}
?>