提交PHP表单后显示查询结果


Displaying query results after submitting a PHP form

我目前正在使用php和mysql进行一个学校项目。我创建了一个带有三个下拉框的表单,用户可以在其中选择他们要查找的数据类型。然而,在提交表单后,我在显示结果时遇到了很多问题。这是我当前的代码:

<?php
require_once 'connection.php';
?>

<form action="stats.php" method ="post">
<input type="hidden" name="submitted" value="true" />
<fieldset>
<legend>
Specify Date, Month, and County
</legend>
<p>
<label for="year">
Please select a year
</label>
<select name= 'year'>
<?php
$query = "select distinct year from unemployed";
$result = $conn->query($query);
while($row = $result->fetch_object()) {
  echo "<option value='".$row->year."'>".$row->year."</option>";
 }
?>
</select>
</p>
<p>
<label for="month">
Please select a month
<label>
<select name= 'month'>
<?php
$query = "select distinct month from unemployed";
$result = $conn->query($query);
while($row = $result->fetch_object()) {
  echo "<option value='".$row->month."'>".$row->month."</option>";
 }
?>
</select>
</p>
<p>
<label for="location">
Please specify a location
</label>
<select name='select'>
<?php
$query = "select * from unemployed";
$result = $conn->query($query);
while ($finfo = $result->fetch_field()) {
  echo "<option value='".$finfo->name."'>".$finfo->name."</option>";
 }
?>
</select>
</p>

<input type ="submit" />
</fieldset>
</form>
<?php
if (isset($_POST['submitted'])) {
include('connection.php');
$gYear = $_POST["year"];
$gMonth = $_POST["month"];
$gSelect = $_POST["select"];
$query = "select $gSelect from unemployed where year='$gYear' and month='$gMonth'";
$result = $conn->query($query) or die('error getting data');

echo"<table>";
echo "<tr><th>Year</th><th>Time</th><th>$gSelect</th></tr>";
while ($row = $result->fetch_object()){
echo "<tr><td>";
echo $row['Year'];
echo "</td><td>";
echo $row['Month'];
echo "</td><td>";
echo $row['$gSelect'];
echo "</td></tr>";
}


echo "</table";
} // end of main if statement
?>

我几乎可以肯定我的问题在于我的while语句。我会显示表列的标题(年、月、$gSelect),但不会显示查询结果。

我试过:

while ($row = $result->fetch_object())
while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC))

这两种方法对我都不起作用。我在php.net上找到了指导。我仍然不知道该怎么办。如果有人能帮我,我真的很感激。

始终检查您的退货:

if( ! $result = $conn->query($query) ) {
  die('Error: ' . $conn->error());
} else {
  while($row = $result->fetch_object()) {
    echo "<option value='".$row->year."'>".$row->year."</option>";
  }
}

在开发脚本时,将error_reporting(E_ALL);放在脚本的顶部也会有很大帮助。

您应该真正考虑将变量作为参数传递到查询中,而不是将它们作为变量直接注入到查询中。这可能导致sql注入攻击。

此外,这里还有一个如何使用PDO和mysql:编写查询的快速示例

//Simple Query
$dbh = new PDO('mysql:host=localhost;dbname=testdb;charset=utf8', 'username', 'password');
//Useful during development.
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
//mysql can have prepares depending on the version: http://stackoverflow.com/questions/10113562/pdo-mysql-use-pdoattr-emulate-prepares-or-not
$dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$sth = $dbh->query("SELECT * FROM table");
var_dump($sth->fetchAll(PDO::FETCH_ASSOC));
//Now with pass params and a prepared statement:
$query = "SELECT * FROM table WHERE someCol = ?";
$sth = $dbh->prepare($query);
$sth->bindValue(1,"SomeValue");
$sth->execute();
$results = $sth->fetchAll(PDO::FETCH_ASSOC));