在页面加载和表单上显示数据库结果使用通配符提交

时间:2013-11-06 22:24:20

标签: php regex

我在尝试在页面加载和表单提交时显示数据库结果时遇到问题。当页面加载时它会一直给我空白页但是当我提交表单时,我会得到结果。

<?php
    $alpha = mysql_real_escape_string($_POST['alpha']);

    $p ="^[".$alpha."]";

    if (!isset($p)&&empty($p)){$p = "^[a-z]";}

    $select = "SELECT u.pname,u.categoryid,p.amountpaid,p.teller,p.handler,
    p.scollection,p.project,p.levies,p.status,q.quarter,q.year,
    p.invoice,q.ordinary_cf,q.special_cf,q.cate_id
    FROM users u
    INNER JOIN tbl_paymentalert p
    ON u.categoryid = p.catid

    INNER JOIN tbl_quartersummary q
    ON p.catid= q.cate_id
    WHERE q.quarter = :quarter AND q.year = :year AND pname REGEXP :p
    ORDER BY u.pname  limit :eu,:limit
";

$q=$conn->prepare($select);
$q->bindValue(':quarter', $quarter, PDO::PARAM_STR);
$q->bindValue(':year', $year, PDO::PARAM_STR);
$q->bindValue(':p', $p, PDO::PARAM_STR);
$q->bindValue(':eu', $eu, PDO::PARAM_INT); 
$q->bindValue(':limit', $limit, PDO::PARAM_INT);
$q->execute();
    ?>

1 个答案:

答案 0 :(得分:2)

好的......所以...你从$_POST获得了价值。

// if you're using mysqli_ or pdo and using a prepared query or data binding
// mysql_real_escape_string is not necessary... 
$alpha = mysql_real_escape_string($_POST['alpha']);

// even if $alpha was empty, $p will always be set and will
// never be empty because of the following statement.  
// if alpha is empty, $p will be "^[]"
$p ="^[".$alpha."]";


// this code will never happen... so your default won't be set.     
if (!isset($p) && empty($p) )
{
    $p = "^[a-z]";
}

做类似的事情......

//        if `$_POST` is set,        use that value,   if not use 'a-z'
$alpha = (isset($_POST['alpha'])) ? $_POST['alpha'] : 'a-z'; 

$p = "^[".$alpha."]";

然后

$q->execute(array($quarter,$year,$p,$e,$limit));

确保设置了这些变量,或者您已经处理了未设置的情况。如果没有任何解释,可能会导致您无法获得任何结果。

(最后编辑,我发誓,除非OP要求澄清或其他事项)
尝试pdo的好工作,通常人们都害怕它并忽略警告。认真,干得好!

相关问题