0

我有以下代码片段，它根据从 MySQL 中提取的数据构建链式选择框。

第一个选择在名为 PartTypeDescription 的列上使用 DISTINCT。如果列中的值本质上是数字（例如：11），则此代码非常有用。您选择第一个选择，然后按应有的方式填充第二个选择。

当数据是文本时会出现问题（例如：管道）。例如，您选择 Plumbing，第二个选择框为空。我假设构建第二个选择框的第二个查询无法正常工作。下面的代码中是否存在不允许文本值的内容？ 

/* Configure the select boxes */

if (isset($_GET['key'])) {
    $key = $_GET['key'];
    switch ($key) {
        case 'callTypeSelect':
            $select = new SelectBox('What vehicle are you working from?','Choose a vehicle');
            $res = mysql_query('SELECT DISTINCT PartTypeDescription FROM ' . DB_TABLE2);
            $callTypes = array();
            for ($i = 0; list($callType) = mysql_fetch_row($res); $i++) {
                $callTypes[] = $callType;
                $select->addItem($callType, 'brandSelect-' . $callType);
            }
            header('Content-type: application/json');
            echo $select->toJSON();
            break;
        default:
            if (strpos($key, 'brandSelect-') === 0) {
                $callType = str_replace('brandSelect-', '', $key);
                $resBrands = mysql_query('SELECT Invm_InventoryNumber FROM ' . DB_TABLE2
                    . ' WHERE PartTypeDescription  = ' . mysql_real_escape_string($callType) . " ORDER BY Invm_InventoryNumber");
                $select = new SelectBox('What part number are you looking for?', 'Pick a part');
                for ($i = 0; list($brand) = mysql_fetch_row($resBrands); $i++) {
                    $select->addItem($brand, 'result-' . $brand . '-' . $callType);
                }
                header('Content-type: application/json');
                echo $select->toJSON();
            } elseif (strpos($key, 'result-') === 0) {
                list($null, $brand, $callType) = explode('-', $key);
                 $res = mysql_query('SELECT * FROM ' . DB_TABLE2
                   . ' WHERE PartTypeDescription = \'' . mysql_real_escape_string($callType) . '\'
                 AND Invm_InventoryNumber = \'' . mysql_real_escape_string($brand) . "'");

                $markup = '';
                for ($i = 0; $row = mysql_fetch_assoc($res); $i++) {
                    //$row = array_map('htmlspecialchars', $row);    it looks like the items is already encoded
                    $markup .= <<<HTML
4

1 回答 1

1

您不能转义单引号内的字符。例如：

$x = 'I don\'t like tomatoes';

这不会像您认为的那样逃脱引用，并且会导致问题。在您的代码中使用此行：

$res = mysql_query('SELECT * FROM ' . DB_TABLE2
   . ' WHERE PartTypeDescription = \'' . mysql_real_escape_string($callType) . '\'
   AND Invm_InventoryNumber = \'' . mysql_real_escape_string($brand) . "'");

您需要使用带有双引号的转义序列来包装字符串。

$res = mysql_query('SELECT * FROM ' . DB_TABLE2
   . " WHERE PartTypeDescription = \'" . mysql_real_escape_string($callType) . "\'
   AND Invm_InventoryNumber = \'" . mysql_real_escape_string($brand) . "'");
于 2012-07-11T13:35:59.943 回答