我写过这样的东西
$sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments` id='".$_GET['id']."'";
但它仍然不起作用,未定义的id说,我能做什么?
<?php
require 'head.php';
require 'navbar.php';
require 'config.php';
if(isset($_COOKIE['taxi'])){
echo '<div class="container" style="margin-top: 10%;">
<div class="col-lg-4"></div>
<div class="panel panel-default col-lg-4">
<div class="panel-heading">Submit Your Comments</div>
<div class="panel-body">
<form method="post" action="comment.php">
<div class="form-group">
<label for="exampleInputEmail1">Name</label>
<input type="text" name="name" class="form-control" id="exampleInputEmail1" placeholder="name">
</div>
<div class="form-group">
<label for="exampleInputPassword1">Comment</label>
<textarea name="comment" class="form-control" rows="3"></textarea>
</div>
<button type="submit" class="btn btn-primary" name="submit">Submit</button>
</form>
</div>
</div>
<div class="col-lg-4"></div>
</div>';
$sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments`";
$query = $con->query($sql);
while ($row = mysqli_fetch_assoc($query))
{
echo "<div class='container'>";
echo "<div class='col-lg-4'></div>";
echo "<div class='col-lg-4' style='margin-top:5%;'>";
echo "<p>Name: " . $row['name'] . "</p>";
echo "<p>Comment: " . $row['comment'] . "</p>";
echo "<p>Time: " . $row['time'] . "</p>";
echo "</div>";
echo "<div class='col-lg-4'></div> ";
echo "</div>";
}
if(isset($_POST['submit'])){
$name = $_POST['name'];
$comment = $_POST['comment'];
$sql = "INSERT INTO `comments`(`id`, `name`, `comment`, `time`) VALUES (NULL,'$name','$comment',CURRENT_TIMESTAMP)";
$query = $con->query($sql);
}
}
else{
echo "<p style='margin-top:5%; text-align:center; font-size:40px;'>Access denied to write comment, but you can see comments</p>";
echo "<a href='login.php'><p style='text-align:center;'> Sign in to write a comment </p></a>";
$sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments`";
$query = $con->query($sql);
while ($row = mysqli_fetch_assoc($query))
{
echo "<div class='container'>";
echo "<div class='col-lg-4'></div>";
echo "<div class='col-lg-4' style='margin-top:5%;'>";
echo "<p>Name: " . $row['name'] . "</p>";
echo "<p>Comment: " . $row['comment'] . "</p>";
echo "<p>Time: " . $row['time'] . "</p>";
echo "</div>";
echo "<div class='col-lg-4'></div> ";
echo "</div>";
}
}
?>
1条答案
按热度按时间gcxthw6b1#
问题要么是:你没有
id
列,因此在尝试选择id
使用此行:潜在问题b:你的
id
列被设置为数据库中的主键。这意味着id
对于插入的每条记录,列自动递增1。但当你插入新行时,你是在试图设置id
至NULL
:尝试将其更改为:
潜在问题c(很可能):您没有设置
$_GET['id']
加载页面时的参数。这本质上是?id=x
你在这么多网址上看到的。正如其他人所提到的,你的查询是可注入的,我知道你说过这只是局部的,但是从一开始就养成好习惯是很好的。