php - 如何创建对特定列的搜索？

Question

如何使用特定字段搜索来搜索数据库？该代码还需要防止 SQL 注入(inject)，但这里是用于学习目的的基本代码。数据库已连接但不显示数据。请帮忙!

这是 html 输入表单。

<h2>Search</h2> 
<form name="search" action="searchresults.php" method="POST">
Seach for: <input type="text" name="find" /> in 
<Select NAME="field">
<Option VALUE="firstName">First Name</option>
<Option VALUE="lastName">Last Name</option>
<Option VALUE="email">email</option>

</Select>
<input type="hidden" name="searching" value="yes" />
<input type="submit" name="search" value="Search" />
</form>

这是基本连接和表格输出。某些代码可能丢失。

<?php 
mysql_connect("127.0.0.1", "root", "pass") or die(mysql_error()) ; 
mysql_select_db("users") or die(mysql_error()) ;



// We preform a bit of filtering 
$find = strtoupper($find); 
$find = strip_tags($find); 
$find = trim ($find); 


$email=$_POST['email'];
$find=$_POST['find'];
$field=$_POST['field'];

$data="SELECT firstName, lastName, email FROM userInfo WHERE upper($field) LIKE '%  $find%'"; 

$result = mysql_query($data);
$count=mysql_numrows($result);

if($count > 0){


echo '<table align="center" width="800" border="0" cellpadding="4">';
echo '<tr height = 200><td>';
echo "<h1><font size='4' color='red'>Search Results</h1></font>";

echo "<table>";
echo "<table border='0' width='750' align='center'>";

echo    "

<td width='30%' align='center'>First Name</td>
<td width='30%' align='center'>Last Name</td>
<td width='40%' align='center'>Email</td>"; 
echo "</tr>";


$row_number = 1;

while ($row = mysql_fetch_array($data)) { 

$id= $row["id"];
$firstName= $row["firstName"];
$lastName= $row["lastName"];
$email= $row["email"]; 

for ($i=0; $i<3; $i++)  {
echo"<td><font size =\"4\" color=\"black\"> $row[$i]</td>";
}
echo"</tr>";

$row_number++;
}
echo "</table>";
echo '</td></tr>';
echo '</table>';

}
?>

Answer 1

$data="从 userInfo WHERE upper($field) LIKE '% $find%' 中选择名字、姓氏、电子邮件";

那个空间LIKE '% $find%'";

可能不正确