選擇具有多個參數的行（ajax和PHP）

Question

美好的一天， 我是PHP/MySQL的新手，嘗試從ajax發送請求，並在具有多個參數的數據庫中選擇一行。 這是做這件事的好方法嗎？

AJAX（jQuery的）：

function readLine(name, firstname) { 
$.ajax({ 
     type: "post", 
     url: "./php/readLine.php", 
     dataType: 'json', 
     data: { name: name, firstname: firstname }, 
     success: function(data) { 
     console.log(data); 
     } 
     error: function(data) { 
     console.log("An error occured!"); 
     } 
}); 
} 

PHP：

<?php 
$sql = "SELECT * FROM table1 WHERE firstname=".intval($_POST['firstname'])." AND name=".intval($_POST['name']); 
$con = mysqli_connect("localhost", "root", "", "myDB"); 
if (!$con) { 
    die("Connection failed: " . mysqli_error($con)); 
} 
$result = mysqli_query($con, $sql); 
$to_encode = array(); 
while($row = mysqli_fetch_array($result, MYSQLI_NUM)){ 
    $to_encode[] = $row; 
} 
echo json_encode($to_encode); 
mysqli_close($con); 
?> 

感謝您的幫助。

Answer 1

首先，您應該使用prepared statements而不是，因爲目前該代碼易受SQL注入攻擊。我無法強調這一點，攻擊者可以用你目前擁有的代碼來破壞你的數據庫。

您應該使用類似於以下內容的東西（取自上面鏈接的頁面，並在同一頁面上取this comment）。請注意，我已將intval調用移除到您的POST數據，因爲我認爲它們是字符串而不是整數。

$to_encode = array(); 
$mysqli = new mysqli("localhost", "root", "password", "myDB"); 

/* check connection */ 
if (mysqli_connect_errno()) { 
    printf("Connect failed: %s\n", mysqli_connect_error()); 
    exit(); 
} 

/* create a prepared statement */ 
if ($stmt = $mysqli->prepare("SELECT * FROM table1 WHERE firstname=? AND name=?")) { 

    /* bind parameters for markers */ 
    $stmt->bind_param("ss", $_POST['firstname'], $_POST['name']); 

    /* execute query */ 
    $stmt->execute(); 

    /* instead of bind_result: */ 
    $result = $stmt->get_result(); 

    /* now you can fetch the results into an array - NICE */ 
    while ($myrow = $result->fetch_assoc()) { 

     // use your $myrow array as you would with any other fetch 
     $to_encode[] = $myrow; 

    } 

    /* close statement */ 
    $stmt->close(); 
} 

/* close connection */ 
$mysqli->close(); 

echo json_encode($to_encode); 

Answer 2

您可以使用帶有預處理語句的PDO來做到這一點，這將確保用戶輸入安全。像這樣：

try { 
    $db = new PDO('mysql:dbname=db_name;host=localhost', 'db_user', 'db_password'); 
} catch (PDOException $e) { 
    die('Connection failed: ' . $e->getMessage()); 
} 

$sql = "SELECT * FROM table1 WHERE firstname=:firstname AND name=:name"; 
$stmt = $db->prepare($sql); 
$stmt->bindParam(':firstname', $_POST['firstname'], PDO::PARAM_STRING); 
$stmt->bindParam(':name', $_POST['name'], PDO::PARAM_STRING); 
$stmt->execute(); 
$result = $stmt->fetchAll(); 

echo json_encode($result); 

將前5行移入包含，那麼您只需要一次該代碼。

Answer 3

$stmt = $con->prepare("SELECT * FROM table1 WHERE name=? and firstname=?"); 
$stmt->bind_param($name ,$firstname); 

// set parameters and execute 
$firstname = mysqli_real_escape_string($con, $_POST['firstname']); 
$name = mysqli_real_escape_string($con, $_POST['name']); 
$stmt->execute(); 
$stmt->bind_result($to_encode); 

$stmt->fetch(); 

echo json_encode($to_encode);