【发布时间】:2017-02-17 08:00:27
【问题描述】:
我正在使用 WordPress 和全局类 $wpdb 来从 MySQL 数据库中检索数据并将结果显示在表格中。
我有 4 个下拉列表,允许用户选择所需的输入,然后系统根据所选输入显示所有相关数据供用户选择。
当我尝试运行代码时,它显示错误:
注意:数组到字符串的转换
第一部分代码:
<?php
/*
Template Name: search info
*/
get_header();
?>
<?php
// code for submit button ation
global $wpdb,$_POST;
//variables that handle the retrieved data from mysql database
if(isset($_POST['site_name']))
{
$site_name=$_POST['site_name'];
}
else { $site_name=""; }
if(isset($_POST['owner_name']))
{
$owner_name=$_POST['owner_name'];
}
else { $owner_name=""; }
if(isset($_POST['Company_name']))
{
$company_name=$_POST['Company_name'];
}
else { $company_name=""; }
if(isset($_POST['Subcontractor_name']))
{
$Subcontractor_name=$_POST['Subcontractor_name'];
}
else { $Subcontractor_name="";}
$site_id = ['siteID'];
$equipment_type = ['equipmentTYPE'];
$lat=['latitude'];
$long=['longitude'];
$height = ['height'];
$owner_contact = ['ownerCONTACT'];
$sub_contact = ['subcontractorCONTACT'];
$sub_company = ['subcontractorCOMPANY'];
if(isset($_POST['query_submit']))
{
//query to retrieve all related info of the selected data from the dropdown list
$query_submit =$wpdb->get_results ("select
site_info.siteID,site_info.siteNAME ,site_info.equipmentTYPE,site_coordinates.latitude,site_coordinates.longitude,site_coordinates.height ,owner_info.ownerNAME,owner_info.ownerCONTACT,company_info.companyNAME,subcontractor_info.subcontractorCOMPANY,subcontractor_info.subcontractorNAME,subcontractor_info.subcontractorCONTACT from `site_info`
LEFT JOIN `owner_info`
on site_info.ownerID = owner_info.ownerID
LEFT JOIN `company_info`
on site_info.companyID = company_info.companyID
LEFT JOIN `subcontractor_info`
on site_info.subcontractorID = subcontractor_info.subcontractorID
LEFT JOIN `site_coordinates`
on site_info.siteID=site_coordinates.siteID
where
site_info.siteNAME = `$site_name`
AND
owner_info.ownerNAME = `$owner_name`
AND
company_info.companyNAME = `$company_name`
AND
subcontractor_info.subcontractorNAME = `$Subcontractor_name`
");
?>
<table width="30%" >
<tr>
<td>Site Name</td>
<td>Owner Name</td>
<td>Company Name</td>
<td>Subcontractor Name</td>
</tr>
<tr>
<td><?php echo $site_name ; ?></td>
<td><?php echo $owner_name ; ?></td>
<td><?php echo $company_name ; ?></td>
<td><?php echo $Subcontractor_name ; ?></td>
<td><?php echo $site_id ; ?></td>
<td><?php echo $equipment_type ; ?></td>
<td><?php echo $lat ; ?></td>
<td><?php echo $long ; ?></td>
<td><?php echo $height ; ?></td>
<td><?php echo $owner_contact ; ?></td>
<td><?php echo $sub_contact ; ?></td>
<td><?php echo $sub_company ; ?></td>
</tr>
</table>
<?php } ?>
第二部分代码用于从数据库中检索数据并将其包含在下拉列表中。
我将不胜感激。
【问题讨论】:
-
您的代码面临 SQL 注入的重大风险
-
是的,我知道我需要知道的是能够检索所需的数据,而不是微调代码以防止 sql 注入和其他可能的攻击
-
您永远不需要设置
global $_POST,因为$_POST是一个超级全局(可在任何地方、任何范围内访问)。 -
@Magnus Eriksson 这不是网站上任何问题的重复
标签: php mysql wordpress drop-down-menu left-join