从下拉菜单中检索数据答案

【问题标题】：Retrieve data from drop down menu从下拉菜单中检索数据
【发布时间】：2014-10-22 22:40:21
【问题描述】：

我创建了一个下拉菜单，但出现了问题。当我选择一个矩阵数字时，它似乎不保存数据。我在文本框中输入了一个值，例如2012456824，然后数据出来了，但是当我没有输入值时，数据也出来了。

这可能是什么原因造成的？

dropdownmenu.html

<form action="searchbook2.php" method="post">
          <font color=black>Search By : </font>
          <select name="choose">
               <option selected="selected">-Please Choose-</option>
               <option value="matricNo">Matric No.</option>
               <option value="bookAccession">Accession No.</option>
          </select>
          <input type="text" name="search">
          <input type="submit" name="submit" value="search" style="background:#996699"><br><br>
</form>

searchbook2.php

<?php
echo "<center><br><br>";

$choose = $_POST['choose'];
if($choose == 'matricNo'){
$search = $_POST['search'];
$sql = mysql_query("SELECT b.book_Accession, b.patron_ID, p.patron_Name, b.book_Title, b.book_Status

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.patron_ID = p.patron_ID
                    WHERE b.patron_ID LIKE '%$search%'");

if(mysql_num_rows($sql) > 0) {
 while($data = mysql_fetch_array($sql)) {
    $patron_ID = $data['patron_ID'];
    echo "<br><br><table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
    echo "<tr><td colspan=2 align=center bgcolor=gray>Loan Item</td></tr>";

    echo "<td width='200'>&nbsp;Patron Id : </td><td width='473'>".$data['patron_ID']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Accession : </td><td>".$data['book_Accession']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
    echo "</tr><tr>";
    echo '<td colspan="2" align=center><a href="bookDetail.php?patron_ID=' . $data['patron_ID'] . '"
    onClick="javascript:return confirm(\'Do you want see this information ?\')">Click Here</a></td>';
    echo "</tr>";
    echo "</table>";
    echo "<br><Br><br>";
 }
 }

}else if($choose == 'bookAccession'){
$search = $_POST['search'];
$sql = mysql_query("SELECT  b.book_Accession, b.patron_ID, p.patron_Name, b.ISBN, b.book_Title, b.book_Author, b.book_Status, b.book_Year,
                    b.book_Category 

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.book_Accession = p.book_Accession
                    WHERE b.book_Accession LIKE '%$search%'");

if(mysql_num_rows($sql) > 0) {
 while($data = mysql_fetch_array($sql)) {
    $book_Accession = $data['book_Accession'];

    echo "<table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
    echo "<tr><td colspan=2 align=center bgcolor=gray>Book Information</td></tr>";

    echo "<td width='200'>&nbsp;Accession No. : </td><td width='473'>".$data['book_Accession']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Id : </td><td>".$data['patron_ID']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Isbn : </td><td>".$data['ISBN']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Author : </td><td>".$data['book_Author']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Year : </td><td>".$data['book_Year']."</td>";
    echo "</tr><tr>";
    echo "<td>&nbsp;Book Category : </td><td>".$data['book_Category']."</td>";

}
 echo "</table>";
 echo "<br><br>";
 }
 }
 else{
 echo "Sorry the data you have been search is not available";
 }
?>

【问题讨论】：

您能否更具体地说明当前代码在做什么以及您的预期输出
不要使用 SQL，它已被弃用，查看 sqli 或 PDO 准备语句，它们对 sql 注入更安全。我认为您错过了嵌套选择，从 html4 开始也已弃用字体标签。尝试将`if(!empty($_POST['search']){$search = $_POST['search'];}
附带说明，您的代码容易受到 SQL 注入的攻击，所有来自用户的输入都应该在用于 sql 查询之前进行清理。
致阿米尔：目前的代码是搜索矩阵没有数据，但我遇到了一个问题，当我输入错误的数据时，数据也会被显示..

标签： php html mysql

【解决方案1】：

我认为您的问题是您没有验证$_POST['search']。因此，如果它为空，您的查询将是这样的：WHERE b.patron_ID LIKE '%%'"what 将返回您数据库中的所有记录。

if (!empty($search)) {
    //Show the table
} else {
    echo 'Plase provide a search condition!';
}

并使用mysql_real_escape_string 转义您的字符串，如果您这样做是为了避免 SQL 注入，但最好使用 mysqli_* 函数或 PDO，因为不推荐使用 mysql_* 函数。

更新：

给你。

<?php
echo "<center><br><br>";

$choose = $_POST['choose'];
if ($choose == 'matricNo') {
    $search = mysql_real_escape_string($_POST['search']);
    if (!empty($search)) { //<---- HERE IS A CHECK
        $sql = mysql_query("SELECT b.book_Accession, b.patron_ID, p.patron_Name, b.book_Title, b.book_Status
                    FROM book b
                    INNER JOIN patrons p 
                    ON b.patron_ID = p.patron_ID
                    WHERE b.patron_ID LIKE '%$search%'");

        if (mysql_num_rows($sql) > 0) {
            while ($data = mysql_fetch_array($sql)) {
                $patron_ID = $data['patron_ID'];
                echo "<br><br><table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
                echo "<tr><td colspan=2 align=center bgcolor=gray>Loan Item</td></tr>";

                echo "<td width='200'>&nbsp;Patron Id : </td><td width='473'>" . $data['patron_ID'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Name : </td><td>" . $data['patron_Name'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Accession : </td><td>" . $data['book_Accession'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Title : </td><td>" . $data['book_Title'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Status : </td><td>" . $data['book_Status'] . "</td>";
                echo "</tr><tr>";
                echo '<td colspan="2" align=center><a href="bookDetail.php?patron_ID=' . $data['patron_ID'] . '"
    onClick="javascript:return confirm(\'Do you want see this information ?\')">Click Here</a></td>';
                echo "</tr>";
                echo "</table>";
                echo "<br><Br><br>";
            }
        }
    } else {
        //This happens if no search criteria given
        echo "Please provide a search condition";
    }
} else if ($choose == 'bookAccession') {
    $search = mysql_real_escape_string($_POST['search']);
    if (!empty($search)) { //<---- HERE IS A CHECK
        $sql = mysql_query("SELECT  b.book_Accession, b.patron_ID, p.patron_Name, b.ISBN, b.book_Title, b.book_Author, b.book_Status, b.book_Year,
                    b.book_Category 

                    FROM book b
                    INNER JOIN patrons p 
                    ON b.book_Accession = p.book_Accession
                    WHERE b.book_Accession LIKE '%$search%'");

        if (mysql_num_rows($sql) > 0) {
            while ($data = mysql_fetch_array($sql)) {
                $book_Accession = $data['book_Accession'];

                echo "<table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
                echo "<tr><td colspan=2 align=center bgcolor=gray>Book Information</td></tr>";

                echo "<td width='200'>&nbsp;Accession No. : </td><td width='473'>" . $data['book_Accession'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Id : </td><td>" . $data['patron_ID'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Name : </td><td>" . $data['patron_Name'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Isbn : </td><td>" . $data['ISBN'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Title : </td><td>" . $data['book_Title'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Author : </td><td>" . $data['book_Author'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Status : </td><td>" . $data['book_Status'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Year : </td><td>" . $data['book_Year'] . "</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Category : </td><td>" . $data['book_Category'] . "</td>";
            }
            echo "</table>";
            echo "<br><br>";
        }
    } else {
        //This happens if no search criteria given
        echo "Please provide a search condition";
    }
} else {
    echo "Sorry the data you have been search is not available";
}
?>

【讨论】：

我应该把这个放在哪里？
您创建查询的任何地方。
如果您尝试理解我所做的事情会更好（因为您只能通过这种方式学习），而不是等待代码复制/粘贴。今天我心情很好，这就是我发布完整代码的原因；）
它的工作！但是，当我搜索示例 2 时，数据库中的所有数据都会出现。为什么？
好的。我不知道，我没有在您的数据库中看到您的数据。试试print你的$sql直接在mysql里运行，看看b.patron_ID或者b.book_Accession有没有记录什么没有包含2。

【解决方案2】：

首先使用 mysqli/PDO，因为 mysql 将在未来的 PHP 版本中被弃用
始终检查您的 POST 或 GET 参数是否不为空，如果它们为空，则提供错误消息或警告

我已编辑代码以检查 $_POST['search'] 是否为空。

    <?php
    echo "<center><br><br>";
    if($_POST['search']!=null)// This line checks if your POST parameter search is null or not.
    {
        $choose = $_POST['choose'];
        if($choose == 'matricNo'){
            $search = $_POST['search'];
            $sql = mysql_query("SELECT b.book_Accession, b.patron_ID, p.patron_Name, b.book_Title, b.book_Status

                FROM book b
                INNER JOIN patrons p 
                ON b.patron_ID = p.patron_ID
                WHERE b.patron_ID LIKE '%$search%'");

            if(mysql_num_rows($sql) > 0) {
               while($data = mysql_fetch_array($sql)) {
                $patron_ID = $data['patron_ID'];
                echo "<br><br><table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
                echo "<tr><td colspan=2 align=center bgcolor=gray>Loan Item</td></tr>";

                echo "<td width='200'>&nbsp;Patron Id : </td><td width='473'>".$data['patron_ID']."</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Accession : </td><td>".$data['book_Accession']."</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
                echo "</tr><tr>";
                echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
                echo "</tr><tr>";
                echo '<td colspan="2" align=center><a href="bookDetail.php?patron_ID=' . $data['patron_ID'] . '"
                onClick="javascript:return confirm(\'Do you want see this information ?\')">Click Here</a></td>';
                echo "</tr>";
                echo "</table>";
                echo "<br><Br><br>";
            }
        }

    }else if($choose == 'bookAccession'){
        $search = $_POST['search'];
        $sql = mysql_query("SELECT  b.book_Accession, b.patron_ID, p.patron_Name, b.ISBN, b.book_Title, b.book_Author, b.book_Status, b.book_Year,
            b.book_Category 

            FROM book b
            INNER JOIN patrons p 
            ON b.book_Accession = p.book_Accession
            WHERE b.book_Accession LIKE '%$search%'");

        if(mysql_num_rows($sql) > 0) {
           while($data = mysql_fetch_array($sql)) {
            $book_Accession = $data['book_Accession'];

            echo "<table width='486' height='314' border='1' cellpadding='0' cellspacing='0' >";
            echo "<tr><td colspan=2 align=center bgcolor=gray>Book Information</td></tr>";

            echo "<td width='200'>&nbsp;Accession No. : </td><td width='473'>".$data['book_Accession']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Patron Id : </td><td>".$data['patron_ID']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Patron Name : </td><td>".$data['patron_Name']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Isbn : </td><td>".$data['ISBN']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Title : </td><td>".$data['book_Title']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Author : </td><td>".$data['book_Author']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Status : </td><td>".$data['book_Status']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Year : </td><td>".$data['book_Year']."</td>";
            echo "</tr><tr>";
            echo "<td>&nbsp;Book Category : </td><td>".$data['book_Category']."</td>";

        }
        echo "</table>";
        echo "<br><br>";
    }
}
else{
   echo "Sorry the data you have been search is not available";
}
}
else
{
    echo 'Search keyword is blank';
}
?>

【讨论】：

感谢您的回答。它的工作，但我在保存搜索值时遇到了问题。例如，当我写入错误的数据时，它会显示我数据库中的所有数据。你能帮我保存文本框中的值吗
您的意思是当您输入错误的搜索关键字（不在数据库中）时，它会给出结果？
是的，我的意思是。
如果您更新问题，使用错误的搜索关键字及其显示的结果会更好。
我认为我的 html 错误.. 它必须是这样的