0

我一直在编写一些代码，其中包含一个要求您输入客户 ID 的表单，一旦提交表单，表单后面的 PHP 将访问数据库并显示有关输入 ID 的信息表。

但是我的 PHP 似乎无法正常工作，当我输入 ID 并点击提交时，我收到此错误消息“您的 SQL 语法有错误；请查看与您的 MySQL 服务器版本相对应的手册以获取正确的语法在第 1 行的 '='987451'' 附近"

这是我的 HTML：

<body>

<h1>Task 8</h1>

<form id="customerform" action="task8.php" method="get">

<p>please fill in the following form</p>
<p>Customer ID:  <input type="text" name="custID" /><br/>
<p><input type="submit"  value="Submit">
<input type="reset" value="Reset"></p>
</form>

</body>

这是我的PHP：

<body>

<?php
$conn = mysql_connect("localhost", "twa312", "dam6av9a");
mysql_select_db("warehouse312", $conn)
or die ('Database not found ' . mysql_error() );

$cust = $_GET["custID"];
$sql = "select * from orders";
$sql = $sql . "where customerID = '$cust'";
$rs = mysql_query($sql, $conn)
or die ('Problem with query' . mysql_error());
?>

<p>information for customer ID <?php echo $cust ?> :</p>

<?php if (mysql_num_rows($rs)>0){ ?>

<table width="700" border="1" cellpadding="10" summary="Customer Details">

<tr>
<th>Order Number</th>
<th>Order Date</th>
<th>Shipping Date</th>
</tr>

<?php while ($row = mysql_fetch_array($rs)) { ?>

<tr>
<td><?php echo $row["orderNumber"]?></td>
<td><?php echo $row["orderDate"]?></td>
<td><?php echo $row["shippingDate"]?></td>
</tr>

<?php } mysql_close($conn); ?>

</table>

<?php } 
else {?> <p>No customer with ID <?php echo $cust ?> in the database</p>
<?php } ?>

</body>

如果您需要更多信息，请提出任何帮助，我们将不胜感激！

4

1 回答 1

4

You're missing a space between your tablename name and WHERE:

$sql = "select * from orders";
$sql = $sql . "where customerID = '$cust'";

should be

$sql = "select * from orders";
$sql = $sql . " where customerID = '$cust'";

or just

$sql = "select * from orders where customerID = '$cust'";

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

Also, you're wide open to SQL injections

于 2013-04-30T14:51:16.000 回答