过滤系统不工作

Question

你好，我让我的过滤系统是一个简单的只有位置和价格范围现在设置一切看起来像这样： 所以我的问题是最小和最大价格范围过滤器不工作位置过滤器正在工作，因为它应该是我面临的唯一问题是最小和最大价格没有任何错误或警告，但食客没有任何反应。

PHP上面的代码：

$cat1 = ''; 

if(isset($_GET["catid"])){ 

    $p1 = ''; 
    $p2 = ''; 
    $catid = $_GET["catid"]; 
    $l1 = substr($catid,0,1); 
    $l2 = substr($catid,1,1); 
    $p1 = "CAT".$l1; 
    if(!empty($l2)){ 
     $p2 = "CAT".$l1."-".$l2; 
     $p3 = $p2; 
    } 
    $cat1 = @$lang[$p1]; 
    $cat2 = @$lang[$p2]; 
} 

$postid = ''; 
$userid = ''; 
$pricemin = ''; 
$pricemax = ''; 
$location = ''; 

if(isset($_POST["filter"])){ 

$pricemin = $_POST["min"]; 
$pricemax = $_POST["max"]; 
$location = $_POST["location"]; 
} 

主要页面代码：

<div class="fp"> 
     <div class="filter"> 
      <b style="padding-left: 10px;">Filters:</b> 
      <form class="filterform" action="" method="post"><br> 
       Location: <br> 
       <input name="location" ><br> 
       Price Range:<br> 
       Min:<input type="text" name="min" size="5"> Max:<input type="text" name="max" size="5"><br><br> 
       <input class="submit-button" type="submit" name="filter" value="Filter"> 
      </form> 
     </div> 
     <div class="posts"> 
      <div id="adcat"><?php 
       if(!empty($cat2)){ 
        ?> 
        <a href="cat.php?catid=<?php echo $l1; ?>" ><?php echo $cat1." » "; ?></a><span><?php echo $cat2; ?></span> 
        <?php 
       } else { 
       echo "<font color='grey'>".$cat1."</font>"; 
       } 
         ?> 
      </div><br><br> 
      <div id="detailformscat"> 
        <?php 
        if(empty($p1) && empty($p2)){ 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } else if(!empty($p2)){ 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE catid='$p2' "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } else { 
         $sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE p.catid LIKE '$p1%' "; 
         if(!empty($location)){ 
          $sql .= "AND location='$location'"; 
         } 
         if(!empty($min)){ 
          $sql.= "AND price>='$min' "; 
         } 
         if(!empty($max)){ 
          $sql.= "AND price<='$max' "; 
         } 
        } 
        $res = mysqli_query($connect,$sql); 
        while ($row = mysqli_fetch_assoc($res)) { 
         $postid = $row["postid"]; 
         ?> 
         <div id="ads"> 
          <div id="adfavcat"> 
            <?php if(!isset($_SESSION["userid"])) { ?> 
            <a href="post.php?login=false" ><img src="image/+fav.png" width="40px" height="40px"></a> 
            <?php } else { 

              $userid = $_SESSION["userid"]; 
              $sql2 = "SELECT * FROM fav WHERE userid='$userid' AND postid='$postid' "; 
              $res2 = mysqli_query($connect,$sql2); 
              $rowcount = mysqli_num_rows($res2); 

              if ($rowcount > 0){ ?> 
               <a href="cat.php?catid=<?php echo $catid; ?>&delete&id=<?php echo $postid?>" ><img src="image/xfav.png" width="40px" height="40px"></a> 
              <?php 
              } else { ?> 
              <a href="cat.php?catid=<?php echo $catid; ?>&add&id=<?php echo $postid; ?>" ><img src="image/+fav.png" width="40px" height="40px"></a> 
              <?php } 
            } ?> 

          </div> 
          <div id="titlepic"> 
          <a href="review.php?id=<?php echo $postid; ?>"><?php echo $row["title"]; ?></a><br> 
          <a href="review.php?id=<?php echo $postid; ?>"><img src="<?php if(!empty($row["path1"])) { echo $row["path1"]; } else echo "image/noimage.png"; ?>" height="100px" width="150px"></a> 
          </div> 
          <div id="datescat"> 
           <b>Date Added:</b> <?php echo date('m/d/Y H:i', $row["dateadded"]); ?><br> 
           <b>Renew Date:</b> <?php if($row["renewdate"] > 0){ echo date('m/d/Y H:i', $row["renewdate"]); } ?><br> 
           <b>Location:</b> <?php echo $row["location"]; ?><br> 
           <b>Price:</b> <?php echo $row["price"]."&pound"; ?><br> 

          </div> 
         </div> 
         <hr width="100%"> 
         <?php 
        } 

       ?> 
     </div> 
      </div> 
    </div> 

Answer 1

我想这是因为你是治疗的价格为字符串，在你写

$sql.= "AND price>='$min' "; 

SQL查询

尝试使用cast/sanitize/filter输入变量$ min & $ max到整数并删除t他引用。

---顺便说一下，我个人也改变了一些东西：

1. 使用原子代替括号
2. 使用ORM并删除从HTML页面的查询（视图）
3. 如果2是不可能的，尝试所有的PHP逻辑移动到PHP文件而不是HTML部分
4. 删除所有国际单项体育联合会，并尝试编写代码，而无需大量的重复

---

您还加入了表而不是过滤，尝试改变

$sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid "; 

与

$sql = "SELECT * FROM posts p JOIN images i ON p.id = i.postid WHERE p.id > 0 "; 

---

变化

$pricemin = ''; 
$pricemax = ''; 

与

$min = ''; 
$max = '';