使用php echo時的SQL語法錯誤$ _SERVER ['PHP_SELF'];

Question

我試圖用PHP的echo $ _ SERVER [「PHP_SELF」]到頁面提交到自身;但不斷收到以下錯誤：您的SQL語法錯誤;檢查與您的MySQL服務器版本相對應的手冊，以在第1行附近使用正確的語法。

頁面上有不同的表單，我對它們都有同樣的問題。

可能是什麼問題的根源？

<?php 
require_once('Connections/speedycms.php'); 
$client_id = mysql_real_escape_string($_GET['id']); 

if (!isset($_SESSION)) { 
    session_start(); 
} 
$MM_authorizedUsers = ""; 
$MM_donotCheckaccess = "true"; 

// *** Restrict Access To Page: Grant or deny access to this page 
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
    // For security, start by assuming the visitor is NOT authorized. 
    $isValid = False; 

    // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 
    // Therefore, we know that a user is NOT logged in if that Session variable is blank. 
    if (!empty($UserName)) { 
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 
    // Parse the strings into arrays. 
    $arrUsers = Explode(",", $strUsers); 
    $arrGroups = Explode(",", $strGroups); 
    if (in_array($UserName, $arrUsers)) { 
     $isValid = true; 
    } 
    // Or, you may restrict access to only certain users based on their username. 
    if (in_array($UserGroup, $arrGroups)) { 
     $isValid = true; 
    } 
    if (($strUsers == "") && true) { 
     $isValid = true; 
    } 
    } 
    return $isValid; 
} 

$MM_restrictGoTo = "login.php"; 
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) { 
    $MM_qsChar = "?"; 
    $MM_referrer = $_SERVER['PHP_SELF']; 
    if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&"; 
    if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0) 
    $MM_referrer .= "?" . $QUERY_STRING; 
    $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer); 
    header("Location: ". $MM_restrictGoTo); 
    exit; 
} 

if (!function_exists("GetSQLValueString")) { 
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{ 
    if (PHP_VERSION < 6) { 
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue; 
    } 

    $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue); 

    switch ($theType) { 
    case "text": 
     $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; 
     break;  
    case "long": 
    case "int": 
     $theValue = ($theValue != "") ? intval($theValue) : "NULL"; 
     break; 
    case "double": 
     $theValue = ($theValue != "") ? doubleval($theValue) : "NULL"; 
     break; 
    case "date": 
     $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; 
     break; 
    case "defined": 
     $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue; 
     break; 
    } 
    return $theValue; 
} 
} 

mysql_select_db($database_speedycms, $speedycms); 
$query_caseStatus = "SELECT progress FROM tbl_accident WHERE id=$client_id"; 
$caseStatus = mysql_query($query_caseStatus, $speedycms) or die(mysql_error()); 
$row_caseStatus = mysql_fetch_assoc($caseStatus); 
$totalRows_caseStatus = mysql_num_rows($caseStatus); 

mysql_select_db($database_speedycms, $speedycms); 
$query_retrieveSolicitor = "SELECT * FROM tbl_solicitors"; 
$retrieveSolicitor = mysql_query($query_retrieveSolicitor, $speedycms) or die(mysql_error()); 
$row_retrieveSolicitor = mysql_fetch_assoc($retrieveSolicitor); 
$totalRows_retrieveSolicitor = mysql_num_rows($retrieveSolicitor); 

mysql_select_db($database_speedycms, $speedycms); 
$query_currentSolicitor = "SELECT currentSolicitor FROM tbl_accident WHERE id=$client_id"; 
$currentSolicitor = mysql_query($query_currentSolicitor, $speedycms) or die(mysql_error()); 
$row_currentSolicitor = mysql_fetch_assoc($currentSolicitor); 
$totalRows_currentSolicitor = mysql_num_rows($currentSolicitor); 
?> 

Answer 1

如果您正在使用從外部吸入的client_id，你應該將其括入單引號，即使它逃了出來，應該是一個整數：

SELECT progress FROM tbl_accident WHERE id='$client_id' 

例如，如果腳本傳遞空client_id，這個查詢變成：

SELECT progress FROM tbl_accident WHERE id= 

，這是一個無效SQL並且導致相同的錯誤：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 

，你可以很容易地使用任何查詢工具進行重現。

Answer 2

您確定問題出在您使用「php echo $ _SERVER ['PHP_SELF']」嗎？ 拋出的錯誤是一個SQL語法錯誤，並無關調用PHP的echo $ _ SERVER [「PHP_SELF」]。

錯誤說，其實「第1行」是相當無用的，因爲這意味着在SQL語法，而不是一個特定頁面的一條線，所以並不真正指向你在其中查詢被調用。

Answer 3

你的問題不是PHP_SELF。你得到的錯誤是因爲你創建的SQL語句之一不是有效的SQL，所以MySQL服務器拒絕它。

查找每個行

mysql_query($query_someQuery, $speedycms) 

這些線之前，加一個statment像

echo $query_someQuery, "<br />","\n"; 
mysql_query($query_someQuery, $speedycms) 

其中$query_someQuery是你實際使用的變量。然後運行你的腳本/加載你的頁面並檢查SQL。它會有一個語法錯誤（如果瀏覽器看到實際返回的內容，請務必查看源代碼）。

一旦你確定了語法錯誤，跟蹤你的代碼並找出它爲什麼會產生不正確的SQL。

Answer 4

試試這個部分後呼應$ CLIENT_ID：

$client_id = mysql_real_escape_string($_GET['id']); 

你在查詢中使用它以後，如果它的空白或無效它可能生成SQL錯誤。