PHP成员搜索的问题

Question

我对PHP还是很新的，所以如果我忽略了一些简单的东西，请原谅我。我正在尝试构建一个会员搜索表单，通过输入一个或多个标准来允许用户查找成员：名字或用户名，城市，州，国家或通过电子邮件地址。如果输入单个字段，则表单可以工作，或者只有当名称/用户名字段具有值时，该表单才有效。假设这是一个逻辑问题。提前致谢。

if (!isset($_POST['fname'])) 
{ 
//If not isset -> set with dummy value 
$_POST['fname'] = "undefine"; 
} 
if (!isset($_POST['city'])) 
{ 
//If not isset -> set with dummy value 
$_POST['city'] = "undefine"; 
} 
if (!isset($_POST['state'])) 
{ 
//If not isset -> set with dummy value 
$_POST['state'] = "undefine"; 
} 
if (!isset($_POST['country'])) 
{ 
//If not isset -> set with dummy value 
$_POST['country'] = "undefine"; 
} 
if (!isset($_POST['email'])) 
{ 
//If not isset -> set with dummy value 
$_POST['email'] = "undefine"; 
} 

// DEFAULT QUERY STRING 
$queryString = ''; 

if ($_POST['fname'] != '') { 
    $fname = $_POST['fname']; 
    $fname = stripslashes($fname); 
    $fname = strip_tags($fname); 
    $fname = preg_replace('#[^A-Za-z 0-9]#i', '', $fname); 
    $fname = mysql_real_escape_string($fname); 
    $queryString = "(firstname LIKE '%$fname%' OR username LIKE '%$fname%')"; 
} else { 
    $queryString = ''; 
} 

if ($_POST['city'] != '') { 

    if (($_POST['fname'] != '') || ($_POST['state'] != '') || ($_POST['country'] != '') || ($_POST['email'] != '')){ 
     $city = $_POST['city']; 
     $city = stripslashes($city); 
     $city = strip_tags($city); 
     $city = preg_replace('#[^A-Za-z 0-9]#i', '', $city); 
     $city = mysql_real_escape_string($city); 
     $queryString .= " AND city='$city'"; 
    } else { 
    $city = $_POST['city']; 
     $city = $_POST['city']; 
     $city = stripslashes($city); 
     $city = strip_tags($city); 
     $city = preg_replace('#[^A-Za-z 0-9]#i', '', $city); 
     $city = mysql_real_escape_string($city); 
    $queryString .= "city='$city'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

if ($_POST['state'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['country']) || ($_POST['email'])){ 
     $state = $_POST['state']; 
     $state = stripslashes($state); 
     $state = strip_tags($state); 
     $state = preg_replace('#[^A-Za-z 0-9]#i', '', $state); 
     $state = mysql_real_escape_string($state); 
     $queryString .= " AND state='$state'"; 
    } else { 
    $state = $_POST['state']; 
     $state = stripslashes($state); 
     $state = strip_tags($state); 
     $state = preg_replace('#[^A-Za-z 0-9]#i', '', $state); 
     $state = mysql_real_escape_string($state); 
    $queryString .= "state='$state'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

if ($_POST['country'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['state']) || ($_POST['email'])) { 
    $country = $_POST['country']; 
    $queryString .= " AND country='$country'"; 
    } 
    else { 
    $country = $_POST['country']; 
    $queryString .= "country='$country'"; 
    } 
} else { 
    $queryString .= ''; 
} 

if ($_POST['email'] != '') { 

    if (($_POST['fname']) || ($_POST['city']) || ($_POST['state']) || ($_POST['country'])){ 
     $email = $_POST['email']; 
       $email = stripslashes($email); 
     $email = strip_tags($email); 
     $email = preg_replace('#[^A-Za-z 0-9,.@-]#i', '', $email); 
     $email = mysql_real_escape_string($email); 
     $queryString .= " AND email='$email'"; 
    } else { 
    $email = $_POST['email']; 
    $queryString .= "email='$email'"; 
    } 
    } else { 
    $queryString .= ''; 
} 

////////////// QUERY THE MEMBER DATA USING THE $queryString variable's value 
$sql = mysql_query("SELECT id, username, firstname, city, state, country FROM members WHERE $queryString AND emailactivated='1' ORDER BY id ASC"); 

Answer 1

//获得像所有发布的数据这

if(isset($_POST['fname'])) 
{ 
    $fname=$_POST['fname']; 
} 

//获取所有字段值

if(empty($fname)) 
{ 
} 
else 
{ 
    $where . ="fname=$fname and "; 
} 
//Check and build where for each field 

// then remove the last and 

$where = rtrim($where, ' AND '); 

if (empty($where)) { 
     $where_str = NULL; 
     } else { 
     $where_str = "WHERE $where"; 
     } 

$query ="select fieldNames from tableName "; 

$query . =$where_str; 

Answer 2

绝对是一个非常可怕的方法来构建查询字符串。我会说废话并重新开始，但由于你是新人，我们只会处理你的事情。

第一步是停止假设你的SQL正在工作。您没有任何错误检查您的查询呼叫，因此您可以通过有用的反馈获得ZERO。因此更改查询调用：

$sql = mysql_query(...query...) or die(mysql_error()); 
           ^^^^^^^^^^^^^^^^^^^^^^---add this 

现在，您将获得实际的MySQL错误消息的一个漂亮的转储，与查询的片段一起说明在何处/如何查询的错误。最有可能的是，鉴于您在那里添加的所有这些字段，您已经忘记了空间或其他内容，并使查询看起来像p=qand z=y（请注意，q和and之间没有空格）。

一旦您收到这些错误消息，您将更容易找出语法错误的位置以及解决该问题的方法。

Answer 3

一对夫妇的问题，我看到：

1. 在你isset测试中，您将未定义的变量'undefine'，但是当你创建你的查询，您测试''。这意味着如果名字是空白的，你将一直在寻找名为undefine的人。

2. 您不应该试图用您的代码修改$_POST变量。您需要将$_POST加载到另一个变量中，并在代码中处理该变量。