时间戳

首页 > 解决方案 > PHP PDO 返回 bool false sorta

php - PHP PDO 返回 bool false sorta

问题描述

当我运行代码和 var 转储结果时，它给出 bool false。我输入错误，在右侧数字键盘上按住 shift 和 0，它 在输入框中与http://sales/form2.php 相呼应。我将它隔开并放入正确的信息，它按预期工作。我不知道是代码还是我的系统 Ubuntu 18.10

    <?php
/*include ('includes/validation.php');*/
include ('includes/validationmysql.php');



/*$dbh = new PDO("pgsql:host=$host;dbname=$dbname", $dbuser, $dbpass);*/
$dbh = new PDO('mysql:host=localhost;dbname=sales', $dbuser, $dbpass);

if(!$dbh) {
      echo "Error : Unable to open database\n";
   } else {
      echo "Opened database successfully\n";
   }

if(isset($_POST["custID"])){
$custID=$_POST["custID"];

 $sql = $dbh->prepare("SELECT CustFirstName, CustLastName, CustAddress, CustCity, CustState, CustZip, CustCellPhone
         FROM customers WHERE custID = '".$custID."'"); 
         $sql->execute();
         $result = $sql->fetch(PDO::FETCH_ASSOC);

var_dump($custID);

var_dump($result);
}
?>

<!DOCTYPE html>
<html>
<head>
<title>Form</title>
</head>

<body>
<h1>Figure It Out</h1>
<form action="" method="post">
<p>CustomerID <input  type="text" name="custID" value="<?php  echo $custID; ?> " size="5"><input type="submit" name="submit" value="submit"></p>

  <textarea>
  <?php
  echo $result['CustFirstName']. ' ' . $result['CustLastName']. "\n";
  echo $result['CustAddress']. "\n";
  echo $result['CustCity']. ' ' . $result['CustState']. ' ' . $result['Custzip']. "\n";
  echo $result['CustCellPhone'];
  ?>
  </textarea>


</form>
</body>
</html>

标签： phpmysqlubuntu

解决方案

您很容易受到 SQL 注入的影响，因为您未正确使用准备好的语句。

$sql = $dbh->prepare("SELECT CustFirstName, CustLastName, CustAddress, CustCity, CustState, CustZip, CustCellPhone 
                      FROM customers WHERE custID = '".$custID."'"); 
$sql->execute();
$result = $sql->fetch(PDO::FETCH_ASSOC);

必须如下：

$sql = $dbh->prepare("SELECT CustFirstName, CustLastName, CustAddress, CustCity, CustState, CustZip, CustCellPhone 
                      FROM customers WHERE custID = ? "); 
$sql->execute([$custID]);
$result = $sql->fetch(PDO::FETCH_ASSOC);

推荐阅读