php post查询mysql,如何在MySQLi查询中使用$ _POST变量？ （php）

I'm currently learning php and am testing around with sqli queries.

I want to have an input field where a number can be entered. This number is used in the sql-query. Unfortunately it doesn't work the way I want.

The text field is stored in index.php as this:

In handler.php, I'm using

$stridEingabe = $_POST["idEingabe"];

And the query contains:

$query = 'SELECT name, beschreibung FROM uebersicht WHERE id = "$stridEingabe"';

$result = mysqli_query($con, $query);

if ($result = mysqli_query($con, $query)) {

/* Array ausgeben */

while ($row = mysqli_fetch_assoc($result)) {

printf ("%s
%s
", $row["name"], $row["beschreibung"]);

}

/* free result set */

mysqli_free_result($result);

}

mysqli_close($con);

?>

Unfortunately I don't get any results when I enter the number into the text box and click the submit-button. But if I write the number in the query without using $stridEingabe, I'm getting the results.

Where is the mistake?

Thanks a lot

解决方案

Seeing that an answer's been submitted before this, thought I'd put one in too and based on a comment I left under the question.

One of the problems here is, you're querying twice which is a major issue, resulting in a syntax error that MySQL is throwing in the background, but you're not listening for it. Plus, your quoting method which I've modified below, just in case it is a string; which we don't know at this time.

$query = 'SELECT name, beschreibung FROM uebersicht WHERE id = "$stridEingabe"';

$result = mysqli_query($con, $query);

^^^^^^^^^^^^

if ($result = mysqli_query($con, $query)) {

^^^^^^^^^^^^

/* Array ausgeben */

while ($row = mysqli_fetch_assoc($result)) {

printf ("%s
%s
", $row["name"], $row["beschreibung"]);

}

what you want is to remove = mysqli_query($con, $query) and add error checking:

$query = "SELECT name, beschreibung FROM uebersicht WHERE id = '".$stridEingabe."'";

$result = mysqli_query($con, $query);

if ($result) {

/* Array ausgeben */

while ($row = mysqli_fetch_assoc($result)) {

printf ("%s
%s
", $row["name"], $row["beschreibung"]);

}

} // brace for if ($result)

// else statement for if ($result)

else{

echo "There was an error: " .mysqli_error($con);

}

Or, better yet using mysqli_real_escape_string().

$stridEingabe = mysqli_real_escape_string($con,$_POST["idEingabe"]);

Although prepared statements are best.

Plus, in regards to SQL injection which is something you're open to, should be using mysqli with prepared statements, or PDO with prepared statements, they're much safer.

Footnotes:

Make sure you are indeed using mysqli_ to connect with and not another MySQL API such as mysql_ or PDO to connect with. Those different APIs do not intermix with each other.

I say this because, the connection method is unknown in your question.

Plus, if you're using your entire code inside the same file, then you should be using a conditional statement for your POST array, otherwise it will thrown a notice immediately on page load; assuming error reporting is enabled on your system.

The notice would be "Undefined index idEingabe..."

I.e.:

if(!empty($_POST['idEingabe'])){...}

Another thing; if your inputted value is an integer, you can use the following functions to make sure they are integers and not a string, if that is what the ultimate goal is:

and using a conditional statement in conjunction with those.

Add error reporting to the top of your file(s) which will help find errors.

error_reporting(E_ALL);

ini_set('display_errors', 1);

// rest of your code

Sidenote: Error reporting should only be done in staging, and never production.