2012-02-19 48 views
0

有沒有更好的方式來表達這個PHP代碼?我收到了表單中的變量,現在需要在輸出文本字符串之前檢查它們是否爲空。當null變量從表單發佈時,表達if else語句

非常感謝提前!

$Capacity = $_POST["Capacity"]; 
$Location = $_POST["Location"]; 
$RoomType = $_POST["RoomType"]; 

echo '<div id="container" style="padding: 15px; background-color: #949494;">'; 
echo '<div style="padding: 15px; background-color: #fff;">'; 
echo '<h2>Search results:</h2>'; 
echo '<h3>Showing'; 
if ($RoomType == '') echo ''; else echo ' '.$RoomType.' '; 
echo ' rooms with a capacity of '. $Capacity .' and over'; 
if ($Location == '') echo ''; else echo ' in '.$Location.' Park'; 
echo '</h3>'; 
+1

切線點:直接回顯用戶輸入數據有可能讓自己受到XSS攻擊...... – 2012-02-19 14:25:04

+0

我該如何解決這個問題? – methuselah 2012-02-19 14:44:57

回答

0

編輯2:我重新審視代碼,使之更有意義。

<?php 
$requiredFields = array(
    'Capacity', 
    'Location', 
    'RoomType' 
); 
// Retrieve only the allowed fields 
$fields = array_intersect_key($_POST, array_flip($requiredFields)); 
// Remove whitespace 
$fields = array_map('trim', $fields); 
// Remove empty values 
$fields = array_filter($fields, 'strlen'); 
// Filter values for HTML output 
$fields = array_map('htmlentities', $fields); 

// We require all fields 
if(count($fields) !== count($requiredFields)) { 
    exit('Your browser sent incorrect data!'); 
} 

// Create the variables 
extract($fields, EXTR_SKIP); 
?> 
<h2>Search Results</h2> 
<h3><?php printf('Showing %s rooms with a capacity of %s and over in %s Park', $RoomType, $Capacity, $Location) ?></h3> 

編輯:新增htmlentities過濾

+0

刪除空值有什麼意義? – 2012-02-19 16:27:35

+0

@ Col.Shrapnel懶惰輸入驗證 – Vitamin 2012-02-19 16:33:16

+0

開放海報沒有要求輸入驗證 – 2012-02-19 16:37:28

-1

,因爲它需要三個操作數(不像說「加」,這是一個二元運算取兩個操作數),你可以使用「三元運算符」它叫三元。操作數之外,它的工作原理是這樣

some true/false expression ? result when true : result when false 

從你的例子:

echo ($RoomType == '') ? '' : ' '.$RoomType.' '; 
+0

這可能會讓我受到XSS攻擊嗎? – methuselah 2012-02-19 14:45:37

+0

沒有更多或更少的原始。我只談到「更加簡潔地表達陳述/陳述」的問題。 – biscuit314 2012-02-19 15:46:38

0
/* Safely retrieve input parameters */ 
$Capacity = filter_input(INPUT_POST, 'Capacity', FILTER_SANITIZE_SPECIAL_CHARS); 
$Location = filter_input(INPUT_POST, 'Location', FILTER_SANITIZE_SPECIAL_CHARS); 
$RoomType = filter_input(INPUT_POST, 'RoomType', FILTER_SANITIZE_SPECIAL_CHARS); 
/* Define html template */ 
$tmpl = <<<EOFHTML 
<div id="container" style="padding: 15px; background-color: #949494;"> 
<div style="padding: 15px; background-color: #fff;"> 
<h2>Search results:</h2> 
<h3>Showing %s rooms with a capacity of %s and over %s 
</h3> 
EOFHTML; 
/* Output result */ 
if(!empty($Location)) $Location = ' in '.$Location.' Park '; 
printf($tmpl, $RoomType, $Capacity, $Location); 
-1

我看不出一點在這樣的檢查

$Capacity = htmlspecialchars($_POST["Capacity"]); 
$Location = htmlspecialchars($_POST["Location"]); 
$RoomType = htmlspecialchars($_POST["RoomType"]); 

echo "<div id='container' style='padding: 15px; background-color: #949494;'> 
<div style='padding: 15px; background-color: #fff;'> 
<h2>Search results:</h2> 
<h3>Showing $RoomType rooms with a capacity of $Capacity and over in $Location Park</h3>"; 

是好的。

+0

如果$ Location是空的,你會得到一個奇怪的短語'..and Park' – Serge 2012-02-20 02:19:42

+0

@SergikS謝謝,我現在看到我忽略了那部分。 – 2012-02-20 05:04:45