PHP 和 MySQL 通过 GET 循环相同的 QueryString

Question

我正在尝试在类别页面上进行电子商务过滤。到目前为止，我可以让它为一种颜色工作，但如果用户检查不止一种颜色，我希望它也搜索另一种颜色。

网址

//current
category.php?colourChoice=White
//more than one
category.php?colourChoice=White&colourChoice=Ruby+Red

我意识到我需要某种形式的数组或分解？

MYSQL

products
---
id      sku     price
1       p22     45.00
2       p33     65.00   
3       p44     70.00

colours
---
id      sku     name
1       p22     White
2       p33     Ruby Red    
3       p44     Black

HTML

<form action="form.php" method="get">
    <input type="checkbox" name="colourChoice" value="White"/>
    <input type="checkbox" name="colourChoice" value="Black"/>
    <input type="checkbox" name="colourChoice" value="Ruby Red"/>
    <input type="checkbox" name="colourChoice" value="Orange"/>
    <input type="submit" value="go">
</form>

PHP

// VARS
$colourName=mysql_real_escape_string($_GET["colourChoice"]);

// MYSQL
$checkSQL=mysql_query("
    SELECT * FROM `products`
    INNER JOIN `colours`
    ON `products`.`sku` = `colours`.`sku`
    WHERE (
    name = '".$colourName."'
        OR name LIKE '".$colourName.";%'
        OR name LIKE '%;".$colourName.";%'
        OR name LIKE '%;".$colourName."'
    )
");

// SHOW RESULTS
while($r = mysql_fetch_array($checkSQL)) {
    echo '
        <div class="product">
            Cost £'.$r['price'].'<br />
        </div>
    ';
}

Answer 1

你必须使复选框数组如下

<form action="form.php" method="get">
    <input type="checkbox" name="colourChoice[]" value="White"/>
    <input type="checkbox" name="colourChoice[]" value="Black"/>
    <input type="checkbox" name="colourChoice[]" value="Ruby Red"/>
    <input type="checkbox" name="colourChoice[]" value="Orange"/>
    <input type="submit" value="go">
</form>

然后，您将在 php 中将多个值签入数组。

foreach($_GET["colourChoice"] as $value){
  /// here you can make concat for where clause.
}

Answer 2

您可以在 PHP 中以数组的形式获取 HTML 输入值：

HTML

<form action="form.php" method="get">
    <input type="checkbox" name="colourChoice[]" value="White"/>
    <input type="checkbox" name="colourChoice[]" value="Black"/>
    <input type="checkbox" name="colourChoice[]" value="Ruby Red"/>
    <input type="checkbox" name="colourChoice[]" value="Orange"/>
    <input type="submit" value="go">
</form>

然后您使用准备/执行语句查询数据库以防止 SQL 注入。

PHP

$placeholders = substr(str_repeat('?, ', count($_GET['colourChoice']), 0, -1);
$query = "
    SELECT * FROM `products`
    INNER JOIN `colours`
    ON `products`.`sku` = `colours`.`sku`
    WHERE name in ($placeholders);
");
$db = new PDO(...);
$stmt = $db->prepare($query);
$stmt->execute($_GET['colourChoice']);
print_r($stmt->fetchAll());