Html表单选择空白以搜索其他字段匹配的所有表

Question

我有一个搜索数据库并返回与指定字段匹配的行的表单。我想为用户提供一个选项，如果该字段留空，只要其他字段匹配，该列是什么都没有关系。现在，如果我留下一个“空白”字段，它将返回数据库中的每个条目。

        Hair Color: <select name="hair">
                    <option value="hairall" selected="selected">--</option>
                    <option value="black" >Black</option>
                    <option value="brown">Brown</option>
                    <option value="blonde">Blonde</option>
                    <option value="white">White</option>
                    <option value="red">Red</option>
                    <option value="other">Other</option>

                </select>
        Height: <select name="height">
                    <option value="heightall" selected="selected">--</option>
                    <option value="smaller">Smaller</option>
                    <option value="small">Small</option>
                    <option value="average">Average - 70in</option>
                    <option value="tall">Tall</option>
                    <option value="taller">Taller</option>
                </select>
        Body Type: <select name="body">
                    <option value="bodyall" selected="selected">--</option>
                    <option value="skinny">Skinny</option>
                    <option value="average">Average - 194lb</option>
                    <option value="heavy">Heavy</option>
                </select>
        Ethnicity: <select name="ethnicity">
                    <option value="ethnicityall" selected="selected">--</option>
                    <option value="white">White</option>
                    <option value="black">Black</option>
                    <option value="asian">Asian</option>
                    <option value="hispanic">Hispanic</option>
                    <option value="middleeast">Middle Eastern</option>
                    <option value="other">Other</option>
                    </select><br/>
        <center><input type="submit" value="Find Me" name="submit" ></center>
    </form>
</div>
<div id="results">
    <?php
            $submit = $_GET['submit'];
            $gender = $_GET['gender'];
            $hair = $_GET['hair'];
            $height = $_GET['height'];
            $body = $_GET['body'];
            $race = $_GET['ethnicity'];

            //Hair All/Specific
            if ($hair=='hairall'){
                $newhair = "black' OR `hair`='brown' OR `hair`='blonde' OR `hair`='white' OR `hair`='red' OR `hair`='other";
            }else
                $newhair=$hair;

            //Height All/Specific
            if ($height=='heightall'){
                $newheight = "smaller' OR `height`='small' OR `height`='average' OR `height`='tall' OR `height`='taller";
            }else
                $newheight=$height;

            //Body Type All/specific
            if ($body=='bodyall'){
                $newbody = "skinny' OR `body`='average' OR `body`='heavy";
            }else
                $newbody=$body;

            //Etnicity All/Specific
            if ($race=='ethnicityall'){
                $newrace = "white' OR `race`='black' OR `race`='asian' OR `race`='hispanic' OR `race`='middleeast' OR `race`='other";
            }else
                $newrace=$race;

            //echo "$newhair <br/> $newheight <br/> $newbody <br/> $newrace<br/>";
            require 'connect.inc.php';

            $query = "SELECT * FROM `table` WHERE `gender`='$gender' AND `hair`='$newhair' AND `height`='$newheight' AND `body`='$body' AND `race`='$race' ORDER BY `id` DESC";

Answer 1

在每个值周围加上括号 - 即 ('$gender') 而不是 '$gender'。这将防止您的 OR 子句弄乱您的 AND 子句，这是您遇到的问题。

如果该字段留空，更好的解决方案是从查询中完全删除检查，但这需要重写大约一半的代码。无论如何，这就是我的大致做法：

// Only accept the specific fields that are expected
$query_fields = array_intersect_key($_GET, array(
    'gender'=>true,
    'hair'=>true,
    'height'=>true,
    'body'=>true,
    'ethnicity'=>true,
));

// Exclude blank fields
$query_fields = array_filter($query_fields, 'strlen');

$database = (require 'connect.inc.php'); // Get connection to database in this variable somehow

$where_parts = array();
foreach($query_fields as $k=>$v) {
    $v = $database->real_escape_string($v);
    $where_parts[] = "`$k` = '$v'";
}

if(!$where_parts)
    die('No filters selected!');

$query = 'SELECT * FROM `table` WHERE '.implode(' AND ', $where_parts).' ORDER BY `id` DESC';