【发布时间】：2015-11-05 22:47:02
【问题描述】：
我有一个下拉输入选择“评估测试类型”，基于该选择，某些数据出现在其下方，并带有一个提交按钮。现在我添加到：“评估测试类型”默认值<option selected='selected'></option> 但是如果选择此选项并单击提交1，我想阻止提交按钮出现
$options = '';
$filter=mysql_query("select afnumber from employees WHERE Status='Employed'");
while($row = mysql_fetch_array($filter)) {
$options .="<option >" . $row['afnumber'] . "</option>";
}
$menu="<form id='filter' name='filter' method='post' action=''>
AFNumber : <select name='SelectAF' id='filter' style='color:grey;'>" . $options . "</select>
Evaluation Test Type : <select name='Type' id='type' style='color:grey;'><option selected='selected'></option><option value='loyalty'>Loyalty</option><option value='performance'>Performance</option></select>
<input type='submit' name='submit1' value='Submit' style='width:80px; height:30px; text-align:center; padding:0px;'>
</form>
<br>
";
echo $menu;
if(isset($_POST['submit1']))
{
$type = $_POST['Type'];
$mysqli = new mysqli("localhost", "root", "Js", "jr");
/* check connection */
if ($mysqli->connect_errno) {
printf("Connect failed: %s\n", $mysqli->connect_error);
exit();
}
if ( $result = $mysqli->query( "SELECT questiontext FROM questioninfo WHERE type='$type'" ) ) {
$html=array();
$html[]="
<form action='' method='post' id='quiz'>
<ol>";
$counter=1;
while( $row = $result->fetch_array() ) {
$question=$row['questiontext'];
$answerA=1;
$answerB=2;
$answerC=3;
$answerD=4;
$answerE=5;
$html[]="
<br/>
<h3>Question {$counter}: {$question}</h3>
<li>
<br/>
<input type='radio' name='question-{$counter}-answers' id='question-$counter-answersA' value='1' />
<label for='question-{$counter}-answers-A'> {$answerA} </label>
<br/>
<input type='radio' name='question-{$counter}-answers' id='question-{$counter}-answersB' value='2' />
<label for='question-{$counter}-answers-B'> {$answerB} </label>
<br/>
<input type='radio' name='question-{$counter}-answers' id='question-{$counter}-answersC' value='3' />
<label for='question-{$counter}-answers-C'> {$answerC} </label>
<br/>
<input type='radio' name='question-{$counter}-answers' id='question-{$counter}-answersD' value='4' />
<label for='question-{$counter}-answers-D'> {$answerD} </label>
<br/>
<input type='radio' name='question-{$counter}-answers' id='question-{$counter}-answersE' value='5' />
<label for='question-{$counter}-answers-E'> {$answerE} </label>
</li>";
$counter++;
}
$html[]="
</ol>
<input type='submit' name='submit' value='Submit' style='width:80px; height:30px; text-align:center; padding:0px;'>
<input type='hidden' name='type' value='{$type}' />
</form>";
echo implode( PHP_EOL, $html );
$result->close();
}
}
if( isset( $_POST['submit'] ) ){
$mysqli = new mysqli("localhost", "root", "Js", "jr");
if ($mysqli->connect_errno) {
printf("Connect failed: %s\n", $mysqli->connect_error);
exit();}
if ($result = $mysqli->query("SELECT * FROM questioninfo WHERE Type='performance'")) {
$row_cnt = $result->num_rows;
$result->close();
}
if ($result = $mysqli->query("SELECT * FROM questioninfo WHERE Type='loyalty'")) {
$row_cnt1 = $result->num_rows;
$result->close();
}
$numQuestions=$row_cnt;
$numQuestions1=$row_cnt1;
$type = $_POST['type'];
if($type == 'performance')
{
for( $counter=1; $counter <= $numQuestions; $counter++ ){
$type = $_POST['type'];
$answer = $_POST['question-'.$counter.'-answers'];
$sql="insert into `question` (`Type`,`Value`) values ('".$type."','".$answer."')";
$mysqli->query($sql);
}
}
else if($type == 'loyalty')
{
for( $counter=1; $counter <= $numQuestions1; $counter++ ){
$type = $_POST['type'];
$answer = $_POST['question-'.$counter.'-answers'];
$sql="insert into `question` (`Type`,`Value`) values ('".$type."','".$answer."')";
$mysqli->query($sql);
}
}
else
{
}
}
【问题讨论】：
-
通过
echo $_SERVER['REQUEST_METHOD'];和var_dump($_REQUEST);在PHP 中检查你得到了什么。 -
@h2ooooooo sql 注入在插入语句上？
-
@dan 我没有看到任何插入语句，但
"SELECT questiontext FROM questioninfo WHERE type='$type'"有$type被注入。而是绑定它。 -
@h2ooooooo 因为 $type 是用户提供的？
标签： php html html-select