php - 如何使用php和html从表单输入框中检查用户的输入对应于mysql中数据库的结果

Question

这就是问题

用户应该输入一个代码，该代码应该由数据库中的 SQL 语句使用 Php 进行验证。

//此代码应检查用户在确认输入字段中输入的代码是否与数据库中的代码相同。

//它从不同的表中收集数据库中的不同字段

//这里是我应该输入确认的表单输入框

代码

    <div class="input-group">
        <span class="input-group-addon">
        <i class="fa fa-money"></i></span>


//this is the entry box named con_code

        <input type="text" name="con_code" id="con_code" class="form-control" required="required" placeholder="Enter you Confirmation Code" />
    </div>

php 语句

<?php 
// the SQL statement to check from the tables
    $check="SELECT payment.instname, payment.firstname, payment.lastname, payment.email, payment.amount, payment.category, payment.confcode, payment.tdate, transactions.transactioncode FROM payment, transactions WHERE payment.confcode='con_code'";

//query to the db
    $result= mysqli_query($conn,$check);

//checks whether the SQL statement is true

    if($result-> num_rows > 0){
        //$conf=$row['confcode'];
        //$amt=$row['amount'];
        //$date=$row['tdate'];
        $msg = "Payment has been Confirmed!!";

//output if the condition is true
        echo $msg; 
    }
    else{

//output if the condition is false
        $ms="Payment Code does not exist!!";
        echo $ms; 
    }
?>  

标签： phphtmlmysql

Answer 1

简化：- !!!没有安全性！

$con_code = $_POST['con_code'];

$check="SELECT payment.instname, payment.firstname, payment.lastname, payment.email, payment.amount,payment.category, payment.confcode, payment.tdate, transactions.transactioncode
     FROM payment, transactions
     WHERE payment.confcode='".$con_code."'";