mysqli准备好声明搜索表单

问题描述：

最近，我问了一个问题，我们清理了一些丑陋的代码我一直在炮制和得到的帮助，我很快要求。感谢那！

原题线程是在这里：PHP - Search database and return results on the same page

我很快就被引导到使用准备好的声明中的mysqli什么，而不是我一直在做，以避免SQL注入和这样。我知道这个建议会以我的方式出现，所以并不奇怪。所以我做了一些更多的挖掘，并相应地重新编写了原始代码。但现在我已经打破了这个形式。

任何人都愿意看看我失踪的东西吗？我是新来的，我在互联网上搜索并没有帮助我自己调试。

<!DOCTYPE html> 
<html> 
<head> 
<title>Client Search Results</title> 
<link rel="stylesheet" href="styles.css"> 
</head> 

<body> 

<div class="container">  
<form id="contact" action="" method="post"> 

<fieldset> 
<h4>Search For Client</h4> 
<input name="search" placeholder="Enter Name Here" type="text"> 
</fieldset> 

<fieldset> 
<button type="submit">Search</button> 
</fieldset> 

</form> 
</div> 

<div class='container'>  
<form id='contact' action='edit.php' method='post'> 

<fieldset> 
<h4>Search Results</h4> 
<select size="5" style="width:100%" name='id' > 

<?php 
// Include database communication info 
include("../../comm/com.php"); 

// Create connection 
$conn = new mysqli($servername, $username, $password, $dbname); 

// Check connection 
if ($conn->connect_error) { 
    die("Connection failed: " . $conn->connect_error); 
} 

// Search 
$search = "%{$_POST['search']}%"; 
$stmt = $db->prepare("SELECT client_id, firstname, lastname, city, state FROM client WHERE firstname LIKE ?"); 
$stmt->bind_param("s", $search); 
$stmt->execute(); 
$stmt->store_result(); 
$numRows = $stmt->num_rows; 
$stmt->bind_result($client_id, $firstname, $lastname, $city, $state); 

if($result > 0) { 
    while ($stmt->fetch()) { 
    echo "<option value='$client_id'>$firstname $lastname - $city, $state</option>"; 
    } 
} 
$stmt->close(); 
?> 

</select> 
</fieldset> 

<fieldset> 
<button type='submit' name='submit'>View Selection</button> 
</fieldset> 

</form> 
<div> 

</body> 
</html>

答

在重写了这段代码很多次后，在接到许多不同方向的帮助之后，这是我定下的代码。像我想要的那样工作，似乎很扎实。

<html> 
<head> 
<title>Client Search Results</title> 
<link rel="stylesheet" href="styles.css"> 
</head> 

<body> 

<div class="container">  
<form id="contact" action="" method="post"> 

<fieldset> 
<h4>Search For Client</h4> 
<input name="search" placeholder="Enter Name Here" type="text" autofocus> 
</fieldset> 

<fieldset> 
<button type="submit">Search</button> 
</fieldset> 

</form> 
</div> 

<div class='container'>  
<form id='contact' action='edit.php' method='post'> 

<fieldset> 
<h4>Search Results</h4> 
<select size="5" style="width:100%" name='client_id' > 

<?php 

// Retrieve Search Term 
if (isset($_POST['search'])) { 
    $search = "%{$_POST['search']}%"; 
} 

// Include Connection Credentials 
include("../../comm/com.php"); 

//Connection to Database 
$link = mysqli_connect($servername, $username, $password, $dbname); 

// Connection Error Check 
if ($link->connect_errno) { 
    echo "Sorry, there seems to be a connection issue."; 
    exit; 
} 

// Prepared Statement For Database Search 
if ($stmt = $link->prepare("SELECT client_id, firstname, lastname, city, state FROM client WHERE firstname LIKE ? OR lastname LIKE ?")) { 

// Bind Search Variable 
    $stmt->bind_param('ss', $search, $search); 

// Execute the Statement 
    $stmt->execute(); 

// Bind Variables to Prepared Statement 
    $stmt->bind_result($client_id, $firstname, $lastname, $city, $state); 

// Fetch Values 
    while ($stmt->fetch()) { 

// Display Results of Search 
     echo "<option value='$client_id'>$firstname $lastname - $city, $state</option>"; 
    } 
} 

// Close Statment 
$stmt->close(); 

// Disconnect from Database 
mysqli_close($link); 
?> 

</select> 
</fieldset> 

<fieldset> 
<button type='submit' name='submit'>View Selection</button> 
</fieldset> 

</form> 
<div> 
</body> 
</html>

mysqli准备好声明搜索表单

相关推荐