当我选择全部时如何显示所有记录

Question

当我在选择onchange事件中选择ALL时，while循环未执行。

dropdown.php 

     <script> 
     function showUser(str) 
     { 
     if (str=="") 
      { 
      document.getElementById("txtHint").innerHTML=""; 
      return; 
      } 
     if (window.XMLHttpRequest) 
      {// code for IE7+, Firefox, Chrome, Opera, Safari 
      xmlhttp=new XMLHttpRequest(); 
      } 
     else 
      {// code for IE6, IE5 
      xmlhttp=new ActiveXObject("Microsoft.XMLHTTP"); 
      } 
     xmlhttp.onreadystatechange=function() 
      { 
      if (xmlhttp.readyState==4 && xmlhttp.status==200) 
      { 
      document.getElementById("txtHint").innerHTML=xmlhttp.responseText; 
      } 
      } 
     xmlhttp.open("GET","getuser.php?q="+str,true); 
     xmlhttp.send(); 
     } 
     </script> 

    <?php 
    $mysqli = new mysqli("localhost", "root", "", "app"); 
    $result = $mysqli->query("SELECT rfq FROM procurement GROUP BY rfq ORDER BY rfq"); 

    $option = ''; 
    while($row = $result->fetch_assoc()) 
    { 
     $option .= '<option value = "'.$row['rfq'].'">'.$row['rfq'].'</option>'; 
    } 
    ?> 

    <select name="users" onchange="showUser(this.value)"> 
      <option value="ALL" selected='ALL'>ALL</option> 
      <?php echo $option; ?> 
    </select> 

    <br> 
    <div id="txtHint"></div> 

getuser.php

<?php 
    $mysqli = new mysqli("localhost", "root", "", "app"); 
    $q=$_GET["q"]; 

    $result1 = $mysqli->query("SELECT *,SUM(unit_cost*quantity) AS total_amount FROM procurement WHERE rfq='".$q."' GROUP BY counter ORDER BY rfq"); 

    echo'<table id="tfhover" cellspacing="0" class="tablesorter"> 
      <thead> 
      <tr> 
       <th id="none" class="none" title="RFQ"></th> 
       <th title="RFQ">RFQ #</th> 
       <th title="Item Name">Item Name</th> 
       <th title="Item Description">Description</th> 
       <th title="Example : Pc, Pcs, Box and Etc.">Unit</th> 
       <th title="Item Price">Unit Cost</th> 
       <th title="Total Item Quantity">QTY</th> 
       <th title="Total Price">Total Amount</th> 
      </tr> 
      </thead>'; 
      echo'<tbody>'; 
    while($row = $result1->fetch_assoc()){ 
    echo'<tr> 
       <td align="center"><a href="comments.php?pn='.$row["rfq"].'"><img src="images/remarks.png" border="0" width="10" height="10" title="Remarks and Notes"></a></td> 
       <td>'.$row['rfq'].'</td> 
       <td>'.$row['item_name'].'</td> 
       <td>'.$row['item_description'].'</td> 
       <td>'.$row['unit'].'</td> 
       <td>'.number_format($row['unit_cost'], 2, '.', ',').'</td> 
       <td>'.$row['quantity'].'</td> 
       <td>'.number_format($row['total_amount'], 2, '.', ',').'</td> 
      </tr>'; 
      } 
     echo "</tbody></table>"; 


    echo $q; 
    if (!$mysqli) { 
     die('Connect Error: ' . mysqli_connect_error()); 
    } 
    mysqli_close($mysqli); 
     ?> 

我身体设置为showuser（STR = “ALL”），但就像在图片时，我选择所有的while循环ISN不执行。问题是什么？

Answer 1

getuser.php必须通过有条件地提供where子句来反映“ALL”的含义。

$q = $_GET["q"]; 
$where = ''; 
if ($q != 'ALL') { 
    $where = " WHERE rfq='$q' "; 
} 
$result1 = $mysqli->query(" 
    SELECT *,SUM(unit_cost*quantity) AS total_amount 
    FROM procurement 
    $where 
    GROUP BY counter ORDER BY rfq 
"); 

请注意，$_GET["q"]的价值没有被清除掉，从而直接使用它在SQL查询中可能导致SQL Injection。