dongzhao2725 2018-09-15 12:50
浏览 306
已采纳

PHP从Firebird获取数据

my question is updating. my new question is this;

  <?php

    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Headers: X-Requested-With');
    header('Access-Control-Allow-Headers: Content-Type');
    header('Access-Control-Allow-Methods: POST,GET,OPTIONS,DELETE,PUT');

    header('Cache-Control:public, max-age=100');

    if ($db = ibase_connect('111.222.333.444:C:\xx\xx\xx\xx\xx\xx.FDB', 'SYSDBA',
      'masterkey')) {



        $sql = "select * from STOK where barkodu='$barkodu'";

        $query =  ibase_prepare($sql);
        $rs=ibase_execute($query);


        if($row = ibase_fetch_row($rs)){

        $stok_adi = $row[2];

        $sonuc->stok_adi = $stok_adi;

      }

        ibase_close($db);

      } 
      else {
        $sonuc->durum = "cevapyok";
        }
      echo json_encode($sonuc);


    ibase_free_query($query);
    ibase_free_result($rs);
 ?>

There is my codes, its working normally with;

$sql = "select * from STOK";

But i want this;

$sql = "select * from STOK where barkodu='$barkodu'";

How can i get $barkodu with http post from external ? Thanks.

By the way; i have changed my ip adress with 111.222.333.444 and my database location with C:\xx\xx\xx\xx\xx\xx.FDB for my safety

  • 写回答

1条回答 默认 最新

  • duanbage2161 2018-09-15 15:59
    关注

    Warning: I don't normally program in PHP, this answer is based on reading the documentation and my knowledge of Firebird.

    Your current code is unsafe and vulnerable to SQL injection. Instead of using string interpolation to put your value directly into the query string, you should use a parameterized query instead.

    That is, you need to change your code to:

    $sql = "select * from STOK where barkodu=?";
    
    $query = ibase_prepare($sql);
    $rs = ibase_execute($query, $barkodu);
    

    Or, given you're not reusing the query:

    $sql = "select * from STOK where barkodu=?";
    $rs = ibase_query($sql, $barkodu);
    

    See also

    If your question instead is how to get the parameter from a form post, then I suggest you look at How to get input field value using PHP, or search for a tutorial on how to get form values using PHP; however that is a problem not directly related to Firebird (nor MySQL).

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥20 python求解八元一次不定方程,无数解中随机输出几组即可(相关搜索:用python)
  • ¥50 libreoffice导出PPTX到PDF中的错误换行问题
  • ¥15 python实现网页视频下载
  • ¥15 如何通过深度图获得物体的完整、正确点云?
  • ¥15 有没有操作系统适用白丁的经典的书籍,如何解决?(标签-学习)
  • ¥15 Catia V5 R20 64位 安装过程中选择orbix配置创建套接字失败
  • ¥100 C51单片机设计交通灯时出现的问题
  • ¥15 R语言爬虫的时候元素和园代码不一样怎么解决呀
  • ¥15 SQL删除添加数据后序号不连续问题。
  • ¥15 首次运行OmniEvent运行报错