PHP页面

Question

喜MySQL的语法错误我收到此错误信息：

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'id']; ?>'' at line 1

运行此代码：

$id = isset($_GET['id']) ? $_GET['id'] : ''; 
    $sql="SELECT * FROM $tbl_name WHERE id='$id'"; 
    $result=mysqli_query($con, $sql); 
    if (!$check1_res) { 
    printf("Error: %s\n", mysqli_error($con)); 
    exit(); 
    } 

$rows=mysqli_fetch_array($result); 
?> 

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC"> 
<tr> 
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bordercolor="1" bgcolor="#FFFFFF"> 
<tr> 
<td bgcolor="#F8F7F1"><strong><?php echo $rows['topic']; ?></strong></td> 
</tr> 

<tr> 
<td bgcolor="#F8F7F1"><?php echo $rows['detail']; ?></td> 
</tr> 

<tr> 
<td bgcolor="#F8F7F1"><strong>By :</strong> <?php echo $rows['name']; ?> <strong>Email : </strong><?php echo $rows['email'];?></td> 
</tr> 

<tr> 
<td bgcolor="#F8F7F1"><strong>Date/time : </strong><?php echo $rows['datetime']; ?></td> 
</tr> 
</table></td> 
</tr> 
</table> 
<BR> 

<?php 

$tbl_name2="forum_answer"; // Switch to table "forum_answer" 
$sql2="SELECT * FROM $tbl_name2 WHERE question_id='$id'"; 
$result2=mysqli_query($con, $sql2)or die(mysql_error()); 
while($rows=mysqli_fetch_array($result2)){ 

?> 

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC"> 
<tr> 
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF"> 
<tr> 
<td bgcolor="#F8F7F1"><strong>ID</strong></td> 
<td bgcolor="#F8F7F1">:</td> 
<td bgcolor="#F8F7F1"><?php echo $rows['a_id']; ?></td> 
</tr> 
<tr> 
<td width="18%" bgcolor="#F8F7F1"><strong>Name</strong></td> 
<td width="5%" bgcolor="#F8F7F1">:</td> 
<td width="77%" bgcolor="#F8F7F1"><?php echo $rows['a_name']; ?></td> 
</tr> 
<tr> 
<td bgcolor="#F8F7F1"><strong>Email</strong></td> 
<td bgcolor="#F8F7F1">:</td> 
<td bgcolor="#F8F7F1"><?php echo $rows['a_email']; ?></td> 
</tr> 
<tr> 
<td bgcolor="#F8F7F1"><strong>Answer</strong></td> 
<td bgcolor="#F8F7F1">:</td> 
<td bgcolor="#F8F7F1"><?php echo $rows['a_answer']; ?></td> 
</tr> 
<tr> 
<td bgcolor="#F8F7F1"><strong>Date/Time</strong></td> 
<td bgcolor="#F8F7F1">:</td> 
<td bgcolor="#F8F7F1"><?php echo $rows['a_datetime']; ?></td> 
</tr> 
</table></td> 
</tr> 
</table><br> 

<?php 
} 

$sql3="SELECT view FROM $tbl_name WHERE id='$id'"; 
$result3=mysqli_query($con, $sql3); 
$rows=mysql_fetch_array($result3); 
$view=$rows['view']; 

// if have no counter value set counter = 1 
if(empty($view)){ 
$view=1; 
$sql4="INSERT INTO $tbl_name(view) VALUES('$view') WHERE id='$id'"; 
$result4=mysqli_query($con, $sql4); 
} 

// count more value 
$addview=$view+1; 
$sql5="update $tbl_name set view='$addview' WHERE id='$id'"; 
$result5=mysqli_query($con, $sql5); 
mysql_close(); 
?> 

<BR> 
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC"> 
<tr> 
<form name="form1" method="post" action="add_answer.php"> 
<td> 
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF"> 
<tr> 
<td width="18%"><strong>Name</strong></td> 
<td width="3%">:</td> 
<td width="79%"><input name="a_name" type="text" id="a_name" size="45"></td> 
</tr> 
<tr> 
<td><strong>Email</strong></td> 
<td>:</td> 
<td><input name="a_email" type="text" id="a_email" size="45"></td> 
</tr> 
<tr> 
<td valign="top"><strong>Answer</strong></td> 
<td valign="top">:</td> 
<td><textarea name="a_answer" cols="45" rows="3" id="a_answer"></textarea></td> 
</tr> 
<tr> 
<td>&nbsp;</td> 
<td><input name="id" type="hidden" value="<?php echo $id; ?>"></td> 
<td><input type="submit" name="Submit" value="Submit"> <input type="reset" name="Submit2" value="Reset"></td> 
</tr> 
</table> 
</td> 
</form> 
</tr> 
</table> 

我想不通这个问题了。需要帮忙。谢谢！

Answer 1

可能你得到一个错误，导致sql注入，或者你使用单引号围绕一个整数。为了防止sql注入，最好的方法是使用预处理语句，但预处理语句只能用于字段，所以在查询中动态更改表名时的最佳做法是使用白名单，在白名单中检查白名单中的值，用静态值设置表格以防止注入。使用filter_input验证$_GET和$_POST值也是理想的选择。

$id=filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT); 
if ($id === false) { 
    //filter failed 
    die('id not a number'); 
} 
if ($id === null) { 
    //variable was not set 
    die('id not set'); 
} 

//white list table 
$safe_tbl_name = ''; 
switch($tbl_name){ 
    case 'Table1': 
     $safe_tbl_name = 'MyTable1'; 
     break; 
    case 'Table2': 
     $safe_tbl_name = 'MyTable2'; 
     break; 
    default: 
     $safe_tbl_name = 'MyDataTable'; 
}; 

$sql="SELECT * FROM `$safe_tbl_name` WHERE id=?"; 
$stmt = $con->prepare($sql); 
$stmt->bind_param("i", $id); 
$stmt->execute(); 
$stmt->bind_result($result); 
if (!$check1_res) { 
    printf("Error: %s\n", mysqli_error($con)); 
    exit(); 
} 

$rows = $stmt->fetch_all(MYSQLI_ASSOC); 

编辑

另外值得注意的，你使用mysqli但是你使用应改变其mysqli零件计数器以下mysql功能。

mysql_close() 
mysql_error() 
mysql_fetch_array() 

编辑

正如@Barmar注意到你正在创建无效的HTML，我强烈建议通过W3C HTML Validator运行你的输出页面和纠正问题。