如何循环php的变量

Question

我在我的论坛网站的评论列表中有问题php 请帮忙 我试图循环所有的用户评论，但它只出现1或失败循环显示所有相同的评论很多号码。

<?php 
include 'connection.php'; 
     echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr>'; 
     echo '<td width="80%" height="20"><strong>Thread :'; 
     $query="select title from topic where topic_id=".$_REQUEST['topic']; 
     $result=mysql_query($query); 
     $row=mysql_fetch_array($result); 
     echo $row['title']; 
    if($row){ 
     do{ 
    echo'</strong></td><td align="center" valign="top"><strong><?php '; 
     $query2="select * from comment where topic_id=".$_REQUEST['topic']; 
     $result2=mysql_query($query2); 
     $row2=mysql_fetch_array($result2); 
     echo $row2['post_date']; 
     echo '</strong></td></tr></table>'; 
    echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr><td align="center" valign="top" height="20"><strong> Post By :<strong></td><td width="85%" ><strong>'; 
     echo $row['title']; 
     echo'</strong></td></tr>'; 
    echo '<tr><td align="center" valign="top"><strong>'; 
      $query3="select * from user_login where email='".$row2['post_by_user']."'"; 
      $result3=mysql_query($query3); 
      $row3=mysql_fetch_array($result3); 
      echo '<br>'.$row3['first_name'].' '.$row3['last_name']; 

     echo '</strong></td><td align="left" valign="top" height=200>'; 
     //displaying list comment 
    echo '<p>'.$row2['description'].'</p><hr>'; 
    }while($row=mysql_fetch_array($result2)); 
     } 
     ?> 
     </td> 
    </tr> 

为什么循环失败？

Answer 1

我重新安排了你的循环。第一件错误的是while($row=mysql_fetch_array($result2))，因为您在该循环中使用$row2，并且更改$row将无济于事。

<?php 
include 'connection.php'; 
echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr>'; 
echo '<td width="80%" height="20"><strong>Thread :'; 
$query = "select title from topic where topic_id=" . $_REQUEST['topic']; 
$result = mysql_query($query); 
$row = mysql_fetch_array($result); 
echo $row['title']; 
if ($row) { 
    echo '</strong></td><td align="center" valign="top"><strong><?php '; 
    $query2 = "select * from comment where topic_id=" . $_REQUEST['topic']; 
    $result2 = mysql_query($query2); 
    while ($row2 = mysql_fetch_array($result2)) { 
     echo $row2['post_date']; 
     echo '</strong></td></tr></table>'; 
     echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr><td align="center" valign="top" height="20"><strong> Post By :<strong></td><td width="85%" ><strong>'; 
     echo $row['title']; 
     echo '</strong></td></tr>'; 
     echo '<tr><td align="center" valign="top"><strong>'; 
     $query3 = "select * from user_login where email='" . $row2['post_by_user'] . "'"; 
     $result3 = mysql_query($query3); 
     $row3 = mysql_fetch_array($result3); 
     echo '<br>' . $row3['first_name'] . ' ' . $row3['last_name']; 

     echo '</strong></td><td align="left" valign="top" height=200>'; 
     //displaying list comment 
     echo '<p>' . $row2['description'] . '</p><hr>'; 
    } 
} 
?> 
</td> 
</tr> 

非常重要：你非常容易发生SQL注入。在提供给SQL之前，请至少清理您的输入。你也在使用折旧的mysql_ *函数。相反，请使用MySQLi或PDO_MySQL扩展名。

备注：错误与代码的可读性成反比。可维护性与可读性的平方成正比。

编辑：如果你想echo $row2['post_date']只有一次循环，你可以使用这样的循环。这将只打印第一行的post_date。

if ($row) { 
    echo '</strong></td><td align="center" valign="top"><strong><?php '; 
    $query2 = "select * from comment where topic_id=" . $_REQUEST['topic']; 
    $result2 = mysql_query($query2); 
    $row2 = mysql_fetch_array($result2); 
    if ($row2) { 
     echo $row2['post_date']; 
     do { 
      echo '</strong></td></tr></table>'; 
      echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr><td align="center" valign="top" height="20"><strong> Post By :<strong></td><td width="85%" ><strong>'; 
      echo $row['title']; 
      echo '</strong></td></tr>'; 
      echo '<tr><td align="center" valign="top"><strong>'; 
      $query3 = "select * from user_login where email='" . $row2['post_by_user'] . "'"; 
      $result3 = mysql_query($query3); 
      $row3 = mysql_fetch_array($result3); 
      echo '<br>' . $row3['first_name'] . ' ' . $row3['last_name']; 

      echo '</strong></td><td align="left" valign="top" height=200>'; 
      //displaying list comment 
      echo '<p>' . $row2['description'] . '</p><hr>'; 
     } while($row2 = mysql_fetch_array($result2)); 
    } 
} 

Answer 2

除了代码中的错误，您还有几个SQL injection vulnerabilities和未转义的输出漏洞。

1. 你$result2变量被分配内你/ while循环。这意味着在循环的每次迭代中它都被覆盖。这永远不会导致超过一次迭代的输出值。你需要花费一些时间来熟悉PHP，数据库（在你的情况下是MySQL），以及SQL injection的性质。

这里是你的代码，重新编写来解决你的逻辑问题和SQL注入漏洞。您需要花一些时间才能了解并解决problems with outputting unescaped user input。

<?php 

    // You will need to define $dbConnection per the MySQLi API. 
    // http://php.net/manual/en/book.mysqli.php 
    include 'connection.php'; 

    echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr>'; 
    echo '<td width="80%" height="20"><strong>Thread :'; 

    $stmt = $dbConnection->prepare('select title from topic where topic_id = ?'); 
    $stmt->bind_param('s', $_REQUEST['topic']); 

    $result = $stmt->get_result(); 
    $row = $result->fetch_assoc(); 

    echo $row['title']; 

    if ($row) 
    { 
    $query2 = "select * from comment where topic_id=".$_REQUEST['topic']; 

    $stmt2 = $dbConnection->prepare('select * from comment where topic_id = ?'); 
    $stmt2->bind_param('s', $_REQUEST['topic']); 

    $result2 = $stmt->get_result(); 

    while ($row2 = $result2->fetch_assoc()) 
    { 
     echo'</strong></td><td align="center" valign="top"><strong><?php '; 
     echo $row2['post_date']; 
     echo '</strong></td></tr></table>'; 
     echo '<table border="1" bgcolor="#FBFBEF" width="100%" height="20"><tr><td align="center" valign="top" height="20"><strong> Post By :<strong></td><td width="85%" ><strong>'; 
     echo $row['title']; 
     echo'</strong></td></tr>'; 
     echo '<tr><td align="center" valign="top"><strong>'; 

     $stmt3 = $dbConnection->prepare('select * from user_login where email = ?'); 
     $stmt3->bind_param('s', $row2['post_by_user']); 

     $row3 = $result3->fetch_assoc() 

     echo '<br>' . $row3['first_name'] . ' ' . $row3['last_name']; 

     echo '</strong></td><td align="left" valign="top" height=200>'; 
     //displaying list comment 
     echo '<p>'.$row2['description'].'</p><hr>'; 
    } 
    } 
    ?> 
    </td> 
</tr> 

Answer 3

您已经使用$ RESULT2在while循环的条件，将其更改为$结果把事情的工作

while($row=mysql_fetch_array($result));