在 MS SQL Server 查询中使用 HTML 输入答案

【问题标题】：Use HTML inputs in MS SQL Server query在 MS SQL Server 查询中使用 HTML 输入
【发布时间】：2018-10-29 20:04:19
【问题描述】：

我编写了一些代码来尝试运行允许用户向 MS SQL Server 2016 数据库添加字段的查询。但是，我无法让它工作。代码是 HTML 和 PHP。

<!-- Form to store new table values -->
<form action="POST">
<!-- Table list of database table names -->
<table id="tableTable">
    <thead>
        <tr>
            <th>Add Field</th>
            <th>Field Type</th>
        </tr>
        <tr>
            <td align="left"><input type="value" name="colName" placeholder="Enter a column name" required /></td>
            <td>
                <select class="js-example-basic-single" name="colType" type="selectable">
                    <option value="VARCHAR(50)">Text up to 50 characters</option>
                    <option value="VARCHAR(200)">Text up to 200 characters</option>
                    <option value="VARCHAR(500)">Text up to 500 characters</option>
                    <option value="INT">Integer</option>
                    <option value="FLOAT(53)">Decimal Number</option>
                </select>
                <a class="btn btn-xs btn-primary" href="editSurveydataDatabase.php"><i class="fa fa-plus"></i></a>
            </td>
        </tr>
    </thead>
</table>
<input type="submit" name="runQuery">
</form>
<?php
    if(isset($_POST['runQuery'])){
        $colName2 = trim(substr($_POST['colName']),0,30);
        $colType2 = trim(substr($_POST['colType']),0,30);
        $query="ALTER TABLE golddb.dbo.engagements ADD ? ?";
        $params=array($colName2, $colType2);
        sqlsrv_query($con, $query, $params);
    }
?>

我真的是 PHP 和 MS SQL 的新手，我将其作为一个爱好项目来做。任何帮助将不胜感激

干杯，

编辑（工作代码）：

<?php
header('Content-type: text/html; charset=UTF-8');
require('db.php');
include("auth.php");
if(isset($_POST['new']) && $_POST['new']==1){
    $colName2 = $_REQUEST['colName'];
    $colType2 = $_REQUEST['colType'];
    $query="ALTER TABLE golddb.dbo.engagements ADD $colName2 $colType2";
    try {
        sqlsrv_query($con, $query);
    } catch(Exception $e) {
       error_log("$e");
    }
    $status = "New Record Inserted Successfully.
    </br></br><a href='view.php'>View Inserted Record</a>";

}
?>
<!DOCTYPE html>
<html>
<div id="main" accept-charset="UTF-8" class="form">
    <h3> Engagements Table </h3>
    <!-- Form to store new table values -->
    <form name="form" method="post" action=""> 
    <input type="hidden" name="new" value="1" />
    <!-- Table list of database table names -->
    <table id="tableTable">
        <thead>
            <tr>
                <th>Add Field</th>
                <th>Field Type</th>
            </tr>
            <tr>
                <td align="left"><input type="value" name="colName" placeholder="Enter a column name" required /></td>
                <td>
                    <select class="js-example-basic-single" name="colType" type="selectable">
                        <option value="VARCHAR(50)">Text up to 50 characters</option>
                        <option value="VARCHAR(200)">Text up to 200 characters</option>
                        <option value="VARCHAR(500)">Text up to 500 characters</option>
                        <option value="INT">Integer</option>
                        <option value="FLOAT(53)">Decimal Number</option>
                    </select>
                    <a class="btn btn-xs btn-primary" href="editSurveydataDatabase.php"><i class="fa fa-plus"></i></a>
                </td>
            </tr>
            <tr>
                <th>Column Name</th>
                <th>Column Type</th>
            </tr>
        </thead>
    </table>
</div>
</html>

【问题讨论】：

我知道这是一个爱好项目。但是太多人从Stack Overflow 复制代码而没有适当考虑。这是一个真的坏主意。当有人尝试添加 1025 列时会发生什么？
对不起，这只是我的
标签。应该是

。抱歉，理查德，我正在复制代码，因为我的原始代码不起作用 - 并且是相似的。我当前的代码不同，不会“修剪”这些值。它使用 $_REQUEST 代替。无论如何感谢您的帮助

标签： php html sql-server

【解决方案1】：

使用此代码：

<?php
header('Content-type: text/html; charset=UTF-8');
require('db.php');
include("auth.php");
if(isset($_POST['new']) && $_POST['new']==1){
    $colName2 = $_REQUEST['colName'];
    $colType2 = $_REQUEST['colType'];
    $query="ALTER TABLE golddb.dbo.engagements ADD $colName2 $colType2";
    try {
        sqlsrv_query($con, $query);
    } catch(Exception $e) {
       error_log("$e");
    }
    $status = "New Record Inserted Successfully.
    </br></br><a href='view.php'>View Inserted Record</a>";

}
?>
<!DOCTYPE html>
<html>
<div id="main" accept-charset="UTF-8" class="form">
    <h3> Engagements Table </h3>
    <!-- Form to store new table values -->
    <form name="form" method="post" action=""> 
    <input type="hidden" name="new" value="1" />
    <!-- Table list of database table names -->
    <table id="tableTable">
        <thead>
            <tr>
                <th>Add Field</th>
                <th>Field Type</th>
            </tr>
            <tr>
                <td align="left"><input type="value" name="colName" placeholder="Enter a column name" required /></td>
                <td>
                    <select class="js-example-basic-single" name="colType" type="selectable">
                        <option value="VARCHAR(50)">Text up to 50 characters</option>
                        <option value="VARCHAR(200)">Text up to 200 characters</option>
                        <option value="VARCHAR(500)">Text up to 500 characters</option>
                        <option value="INT">Integer</option>
                        <option value="FLOAT(53)">Decimal Number</option>
                    </select>
                    <a class="btn btn-xs btn-primary" href="editSurveydataDatabase.php"><i class="fa fa-plus"></i></a>
                </td>
            </tr>
            <tr>
                <th>Column Name</th>
                <th>Column Type</th>
            </tr>
        </thead>
    </table>
</div>
</html>

【讨论】：