我希望所有客户在进入下一步交易之前输入表格中的特定号码

Question

<form action='' method='POST'>
    <table align="center">

        <tr><td>Transaction Access Code:</td></tr>
        <tr><td><input type="password" name="code1"></td></tr>
        <tr><td class="button1"><input type="submit" name="submitBtn" value="Log In" class="button"></td></tr>
    </table>
</form>

     <?php
if(isset($_REQUEST['submitBtn'])){
include '_inc/dbconn.php';

$code1=$_REQUEST['code1'];

$sql="SELECT code1 FROM code WHERE code1='$code1'";
$result=mysql_query($sql) or die(mysql_error());
$rws=  mysql_fetch_array($result);


if($rws[0]==$code1 ){
header("customer_transfer_process.php");}        
   else
        header("customer_transfer_process1.php");}


?>

Answer 1

Your code had some errors. You also should always scrub user input when using it in a database transaction.

<form method='POST'>
    <table align="center">

        <tr><td>Transaction Access Code:</td></tr>
        <tr><td><input type="password" name="code1"></td></tr>
        <tr><td class="button1"><input type="submit" name="submitBtn" value="Log In" class="button"></td></tr>
    </table>
</form>

<?php

if(isset($_POST['code1'])){ 
    include '_inc/dbconn.php';

    $code1 = htmlspecialchars($_POST['code1']); // sanitize user input

    $sql="SELECT code1 FROM code WHERE code1='{$code1}'";

    $result = mysql_query($sql) or die(mysql_error());
    $rws = mysql_fetch_array($result);

    if($rws[0]==$code1 ){ //success, transfer
        header("customer_transfer_process.php");
    } else { //fail, send them somewhere else
        header("customer_transfer_process1.php");
    }
}
?>