php 按用户过滤

发布于 2024-11-04 06:46:10 字数 1074 浏览 0 评论 0原文

我收到了报告清单。默认情况下，报告列表将显示所有报告而不进行过滤。当下拉过滤器点击时，它将按名称过滤结果。知道如何修复它吗？

function getReportSingleMonth($month, $year, $id_user=NULL) {
   $month = $db->real_escape_string($month);
   $year = $db->real_escape_string($year);
   $db->query("SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year' AND id_user='$id_user'");
}

html部分：

<form method="post" name="report_filter" action="<?= $_SERVER['PHP_SELF'];?>?report&month=<?= $_GET['month'];?>&year=<?= $_GET['year'];?>">
<div align="right"><select name="user_name" onchange="report_filter.submit();"><option value="--">Filter by:</option><option value="1">Andi</option>M<option value="2">Jenny</option><select></div>    
<? if(isset($_POST['user_name'])):
    $admin->getReportSingleMonth($_GET['month'], $_GET['year'], $_POST['user_name'])     
else :
    $admin->getReportSingleMonth($_GET['month'], $_GET['year']);
endif;
?>
</form>

原文

ive got list of reports. for default, the report list will be showing all reports without filtering. when drop down filter click, it will filter the result by name. anyidea how to fix it?

function getReportSingleMonth($month, $year, $id_user=NULL) {
   $month = $db->real_escape_string($month);
   $year = $db->real_escape_string($year);
   $db->query("SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year' AND id_user='$id_user'");
}

the html part:

<form method="post" name="report_filter" action="<?= $_SERVER['PHP_SELF'];?>?report&month=<?= $_GET['month'];?>&year=<?= $_GET['year'];?>">
<div align="right"><select name="user_name" onchange="report_filter.submit();"><option value="--">Filter by:</option><option value="1">Andi</option>M<option value="2">Jenny</option><select></div>    
<? if(isset($_POST['user_name'])):
    $admin->getReportSingleMonth($_GET['month'], $_GET['year'], $_POST['user_name'])     
else :
    $admin->getReportSingleMonth($_GET['month'], $_GET['year']);
endif;
?>
</form>

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

爱冒险 2024-11-11 06:46:10

在旧版本的 MySQL 中，您不能在整数值两边加上引号。尝试切换这一行：

$db->query("SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year'" AND id_user=$id_user");

再看一遍，我注意到您并不总是要传递 user_id。考虑到这一点，应该更改函数：

function getReportSingleMonth($month, $year, $id_user=NULL) {
    $month = $db->real_escape_string($month);
    $year = $db->real_escape_string($year);
    $query = "SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year'";
    if ( is_int( $id_user ) ) {
        $query .= ' and id_user=' . $id_user;
    }
    $db->query( $query );
}

现在，只有将查询的 id_user 部分传递给函数时，才会添加它。

我还建议使用 sprintf

In older versions of MySQL you can't put quotes around integer values. Try switching this line:

$db->query("SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year'" AND id_user=$id_user");

Looking again, I noticed that you're not always going to pass a user_id. With that in mind the function should be changed:

function getReportSingleMonth($month, $year, $id_user=NULL) {
    $month = $db->real_escape_string($month);
    $year = $db->real_escape_string($year);
    $query = "SELECT * FROM user WHERE MONTH(date)='$month' AND YEAR(date)='$year'";
    if ( is_int( $id_user ) ) {
        $query .= ' and id_user=' . $id_user;
    }
    $db->query( $query );
}

Now the id_user part of the query is only added if it was passed to the function.

I also recommend using sprintf

回复收藏 0 原文

醉生梦死 2024-11-11 06:46:10

我认为问题是您需要更改此设置：


$admin->getReportSingleMonth($_GET['month'], $_GET['year'], $_POST['user_name']);

看起来您的获取报告的函数需要用户 ID（假设为整数值），并且您似乎使用 $_POST['user_name'] 值向其发送一个字符串。

I think the problem is that you need to change this:


$admin->getReportSingleMonth($_GET['month'], $_GET['year'], $_POST['user_name']);

It looks like your function for getting reports requires as user id (assuming an integer value) and you appear to be sending it a string using the $_POST['user_name'] value.

回复收藏 0 原文

苍暮颜 2024-11-11 06:46:10

以下是一些（可能的）问题：

您的 getReportSingleMonth() 似乎过滤了 $month 和 $year 但不是 $id_user< /code> （即SQL注入）
正如其他人指出的，您引用了id_user< /code> SQL 查询中的值。
您没有关闭
您有一个，它将被视为预期的用户选项（更改为 value=""）。