forms - 从 MySQL 表中检索 CGI 表单文本框中的值

Question

我有一个在 cgi 文件中看起来像这样的表单：

print "<FORM NAME='LAYOUTFORM' ACTION='Handler.cgi' METHOD=POST>";
print "<table border='0' align=center>\n";
print "<tr><td>Search by:<SELECT ID='Forms Combo Box1' NAME='what_to_do'><OPTION VALUE='title'>Title</OPTION><OPTION VALUE='description'>Description</OPTION><OPTION   VALUE='author'>Author</OPTION></td>";
print "<td><INPUT ID='SearchArea' TYPE=TEXT NAME='searchbox' VALUE='' SIZE=27 MAXLENGTH=100></td>";
print "<td><INPUT TYPE=SUBMIT NAME='searchbutton' VALUE='Search' ID='Form_Search'></td></tr>";
print "</table>\n";
print "</form>";

然后我有这个：

#!/usr/local/bin/perl

use DBI;
use DBD::mysql;
use CGI qw(:standard);

$searchinput = param('searchbox');

print "Content-type: text/html\n\n";

my $dbh = DBI->connect( "DBI:mysql:database", "username", "password" ) or
die( "Could not make connection to database: $DBI::errstr" );

my $sth = $dbh->prepare( q(SELECT * FROM BookStore WHERE bAuthor = $searchinput) ) or 
die( "Cannot prepare statement: ", $dbh->errstr(), "\n" );

my $rc = $sth->execute() or
die( "Cannot execute statement: ", $sth->errstr(), "\n" );

我在命令行中收到此错误：

Uknown column '$searchinput' in 'where clause' at Search.cgi line 17.

我想要做的是用户将在 main.cgi 上的文本框中输入一个名称。然后点击搜索按钮，search.cgi 将检索与表列匹配的行的信息。

Answer 1

尝试更改此行：

my $sth = $dbh->prepare( q(SELECT * FROM BookStore WHERE bAuthor = $searchinput) ) or 
die( "Cannot prepare statement: ", $dbh->errstr(), "\n" );

至：

my $query = sprintf ('SELECT * FROM BookStore WHERE bAuthor = %s', 
                     $dbh->quote("$searchinput"));