安排勾选框的问题

Question

我正在做一个需要填写字段的 PHP 表单 - 在提交表单后，冲浪者有一个部分是关于编辑申请表中的字段...

技能集在原始页面中打勾，但在编辑技能集时，我输入的代码显示复选框的排列顺序与原始页面不同。

这是原始申请页面，其中复选框在被选中后但在提交之前以及可能对表单进行编辑之前：

如果申请人想编辑字段，这里是字段提交并由服务器处理到数据库后的申请页面。他们完全混乱了！

我希望第二个图像在应用程序完成时生成一个复选框列表，就像第一个图像一样。

从名为 Skillset 的数据库表中选择或检索字段，并与从该表插入到另一个名为 emprecords 的表中的值进行比较。通过在 emprecords 表中运行 for 循环，我能够回显或打印出特定申请人已插入但我不能为阵列中的技能列表以正确的顺序打印选定的复选框。我希望上面的图片会有所帮助。 这是在网站上为申请人编辑字段的页面的 PHP 代码：

<br><br><H2 align="center">SKILLS SET</H2>
<br>
<label for="skills" size="3">Pick Your Skill(s): </label>
<br><br>
<tr>

<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    <tr>
        <td valign="top">
        <?php

        $id = $_GET["id"];

        $query2 = "SELECT * FROM emprecords WHERE id ='$id'";
        $record_set2 = $dbs->prepare($query2);
        $record_set2 -> execute();
        $row2 = $record_set2->fetch(PDO::FETCH_ASSOC);
        $sk = $row2['skills'];
        $skills1 = explode(",", $sk);
        for ($i=0; $i< count($skills1); $i++) {
            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills1'checked>$skills1[$i]<br>"; 
        }

        $list = "
        SELECT *
        FROM skillsset
        WHERE category='Engineering'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();

        if(!isset($_POST['submitd'])) {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
            {
                $skills = $row["skills"];
                echo "
                <form action='' method='post'>
                <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";
            }
        }
        else {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
                $skills = $row["skills"]; 
                if(strlen($skills)>0){
                    if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {
                        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
                    }
                    if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])){
                        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                    } else {
                        if(!in_array($skills, $_POST['skills'])) {
                            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                        } 
                    }
                }
                echo "</form>";
            }
        }
        ?>
        </td>
        <td valign="top">
        <?php
        $list = "
        SELECT *
        FROM skillsset
        WHERE category='Information'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();


        if(!isset($_POST['submitd'])){
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
            {
                $skills = $row["skills"];
                echo "
                <form action='' method='post'>
                <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";

            }
        }
        else {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
                $skills = $row["skills"];
                if(strlen($skills)>0) { 
                    if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {

                    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
                    }
                    if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])) {

                    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                    } else {
                        if(!in_array($skills, $_POST['skills'])){
                            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                        }
                    }
                }
                echo "</form>";
            }
        }
        ?>
        </td>
    </tr>
</table>

请帮我解决这个难题。

Answer 1

必填链接： Your code is open to SQL injection

让我们从小事做起。

您可能希望将 Skills Set 更改为 Skill Set（请参阅？从小处开始：）

您在<td>Information Technologies</td> 之后缺少结束</tr>

你正在这样做：

if(!isset($_POST['submitd'])) {
    while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
    {
        $skills = $row["skills"];
        echo "
        <form action='' method='post'>
        <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";
    }
}
else ...

您为每个输入回显一个新的<form>，但您只关闭else 中的表单。忘记这一点，把 <form> 贴在整个桌子周围。

<form method='POST' action=''>
<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    </tr>
    <tr>
        <td valign="top">
        ...
</table>
</form>

此外，还不清楚后面的代码做了什么，我读了几遍才明白。我自己这样做是有罪的，但我想建议您在代码复杂时尝试评论代码的 intent。

if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
}
if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
} else if(!in_array($skills, $_POST['skills'])) {
        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
    } 
}

注意，实际询问的问题前面已经描述了

以下代码是问题所在

$id = $_GET["id"];

$query2 = "SELECT * FROM emprecords WHERE id ='$id'";
$record_set2 = $dbs->prepare($query2);
$record_set2 -> execute();
$row2 = $record_set2->fetch(PDO::FETCH_ASSOC);
$sk = $row2['skills'];
$skills1 = explode(",", $sk);
for ($i=0; $i< count($skills1); $i++) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills1'checked>$skills1[$i]<br>"; 
}

由于您使用所选技能的值回显<input>s，因此您会显示复选框两次。

如果您想选中员工（猜测它是来自名称 emprecords 的员工）之前选择的技能框，那么您应该将技能放在一个数组中，并在 echoing out 时检查该数组复选框。

下面的代码不仅仅是为了简化您的代码。您应该能够使用它替换您发布的所有代码。也知道有几种方法可以做你想做的事情。我把它留给你找到最佳解决方案。

<br><br><H2 align="center">SKILL SET</H2>
<br>
<label>Pick Your Skill(s):</label>
<br><br>

<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    </tr>
    <tr>
<?php
    $empSkills = array();
    if(isset($_GET['id'])) {

        $id = $_GET["id"];

        // use this try catch to catch potential errors
        try {
            // note how $query2 has :id at the end. Using ->prepare() and ->execute(with array parameter) is one good way to protect yourself from SQL injection attacks
            // also, only pull the columns that you're going to actually use
            $query2 = "SELECT skills FROM emprecords WHERE id =:id";
            $record_set2 = $dbs->prepare($query2);
            $record_set2 -> execute(array(':id'=>$id));
            $row2 = $record_set2->fetch(PDO::FETCH_ASSOC);

            $sk = $row2['skills'];
            $empSkills = explode(",", $sk);

            // always perform clean-up
            $record_set2->closeCursor();
        } catch (PDOException $e) { // always perform error checking on PDO
            // print whatever error messages you feel appropriate
            print "Error!: " . $e->getMessage() . "<br/>";
            die(); // stop executing the script on error (up to you)
        }
    }
    // CHAR_LENGTH() is a MySQL function that returns the number of characters in the string passed to it
    try {
        $list = "
        SELECT skills
        FROM skillsset
        WHERE CHAR_LENGTH(skills) > 0 AND category='Engineering'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();
        // this is a function. it is defined below
        printSkillsTd($listAHI, $empSkills);
        $listAHI->closeCursor();
    } catch (PDOException $e) {
        print "Error!: " . $e->getMessage() . "<br/>";
        die();
    }

    try {
        $list = "
        SELECT skills
        FROM skillsset
        WHERE CHAR_LENGTH(skills) > 0 AND category='Information'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();

        printSkillsTd($listAHI, $empSkills);
        $listAHI->closeCursor();
    } catch (PDOException $e) {
        print "Error!: " . $e->getMessage() . "<br/>";
        die();
    }

/**
 * This function prints out the all skills in the PDOStatement $listAHI as checkboxes. It "checks" the checkbox if the skill is in $empSkills
 */
function printSkillsTd($listAHI,$empSkills) {
    echo '
            <td valign="top">';

    while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
        $skill = $row['skills'];

        // note how i left out the 'id' attribute. The id attribute of an element must be unique on the entire page. You could make the `id` something like `skill_$skill` but i don't see why you would need an `id` at all from the posted code
        echo "
                <label><input type='checkbox' name='skills[]' value='$skill'";
        if(in_array($skill,$empSkills))
            echo " checked";
        echo ">$skill</label><br>";
    }

    echo '
            </td>';
}
        ?>
    </tr>
</table>