douzhantanju1849 2015-07-07 18:40
浏览 59

不从MySQL数据库中获取数据

I am trying to fetch data from my data base, but it's not giving me any output. It's only displaying "All Charges". My code is below:

<?php
        include 'preCode.php';
        include 'header.php';

        echo '<body><div class="standardLayout">';
        include 'systemMenu.php';
        echo '<h4>All Charges</h4>';

          $user = unserialize($_SESSION['user']);
          echo $query = "SELECT * FROM billingItems WHERE userID=' " . $user-> userID .  " ' ORDER BY deliveryTimestamp DESC"; 
          $result = mysqli_query($db, $query);
         while ($row = mysqli_fetch_array($result)) {

        echo  $row['type'] . '<br>' . 
                'Cost: $' . $row['amount'] . '<br>' . 
                ' Finalized: ' . $row['deliveryTimestamp']  ;

}
        echo '</div></body></html>';

        $_SESSION['user'] = serialize($user);
        include 'footer.html';
?>

Here is the output from echo $query;:

All Charges object(user)#2 (11) { ["orders"]=> NULL ["fName"]=> string(6) "kimmie" ["lName"]=> string(4) "kaur" ["address"]=> string(10) "6768bbnmmn" ["phone"]=> string(11) "66767798898" ["email"]=> string(6) "kimmie" ["userID"]=> string(3) "108" ["password"]=> string(4) "kaur" ["passwordX"]=> NULL ["amountOwed"]=> string(1) "0" ["zip"]=> string(6) "768798" } SELECT * FROM billingItems WHERE userID=' 108 ' ORDER BY deliveryTimestamp DESC

  • 写回答

1条回答 默认 最新

  • dsv73806 2015-07-07 20:01
    关注

    Seems to me that your query building is a problem, because this

    $query = "SELECT * FROM billingItems WHERE userID=' " . $user-> userID .  " ' ORDER BY deliveryTimestamp DESC";
    

    will give you this if the ID is "bob".

    SELECT * FROM billingItems WHERE userID=' bob ' ORDER BY deliveryTimestamp DESC
    

    You are embedding spaces around the ID, which doesn't match the contents of the column.

    The safer way to do this is to use prepared statements and bind parameters so that you don't run into these kinds of bugs. It will also keep you safe from SQL injection. See this question for details: How can I prevent SQL-injection in PHP?

    评论

报告相同问题?

悬赏问题

  • ¥15 微信会员卡接入微信支付商户号收款
  • ¥15 如何获取烟草零售终端数据
  • ¥15 数学建模招标中位数问题
  • ¥15 phython路径名过长报错 不知道什么问题
  • ¥15 深度学习中模型转换该怎么实现
  • ¥15 HLs设计手写数字识别程序编译通不过
  • ¥15 Stata外部命令安装问题求帮助!
  • ¥15 从键盘随机输入A-H中的一串字符串,用七段数码管方法进行绘制。提交代码及运行截图。
  • ¥15 TYPCE母转母,插入认方向
  • ¥15 如何用python向钉钉机器人发送可以放大的图片?