index.php?action=viewpost&id=1 索引中的这段代码:
if(isset($_GET['action']) && isset($_GET['id']))
{
$id = $_GET['id'];
if($action == "viewpost")
{
// action is viewpost
if(!ctype_digit($id))
{
// id isnt digit
die();
}
else
{
// viewpost
include('viewpost.php');
}
}
viewpost.php 可能看起来像:
只是为了确保在直接访问 viewpost.php 时不会发生任何不良情况,如果 viewpost.php 存在,您可以在 url 中看到,或者只是在此处进行安全性 (!ctype_digit($_GET['id'] ))
// since its already been secured with !ctype_digit, we can run queries right away
$q_findPost = mysqli_query($mysqli, "SELECT * FROM posts WHERE id=$id");
$r = mysqli_fetch_assoc($q_findPost);
// div stuff