评论系统显示单个帖子php的多个帖子。 这是代码

Question

I have written something like

$sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments` id='".$_GET['id']."'";

But it is still not working, says undefined id, what can I do?

<?php
require 'head.php';
require 'navbar.php';
require 'config.php';

if(isset($_COOKIE['taxi'])){
        echo '<div class="container"  style="margin-top: 10%;">
                <div class="col-lg-4"></div>
                   <div class="panel panel-default col-lg-4">
                    <div class="panel-heading">Submit Your Comments</div>
                      <div class="panel-body">
                        <form method="post" action="comment.php">
                          <div class="form-group">
                            <label for="exampleInputEmail1">Name</label>
                            <input type="text" name="name" class="form-control" id="exampleInputEmail1" placeholder="name">
                          </div>
                          <div class="form-group">
                            <label for="exampleInputPassword1">Comment</label>
                            <textarea name="comment" class="form-control" rows="3"></textarea>
                          </div>
                          <button type="submit" class="btn btn-primary" name="submit">Submit</button>
                        </form>
                      </div>
                </div>
                <div class="col-lg-4"></div>
                </div>';

        $sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments`";
        $query = $con->query($sql);

        while ($row = mysqli_fetch_assoc($query))
        {
            echo "<div class='container'>";
            echo "<div class='col-lg-4'></div>";
            echo "<div class='col-lg-4' style='margin-top:5%;'>";
            echo "<p>Name: " . $row['name'] . "</p>";
            echo "<p>Comment: " . $row['comment'] . "</p>";
            echo "<p>Time: " . $row['time'] . "</p>";
            echo "</div>";
            echo "<div class='col-lg-4'></div> ";
            echo "</div>";
        }

    if(isset($_POST['submit'])){
        $name = $_POST['name'];
        $comment = $_POST['comment'];

        $sql = "INSERT INTO `comments`(`id`, `name`, `comment`, `time`) VALUES (NULL,'$name','$comment',CURRENT_TIMESTAMP)";
        $query = $con->query($sql); 


    }
}
else{
        echo "<p style='margin-top:5%; text-align:center; font-size:40px;'>Access denied to write comment, but you can see comments</p>";
        echo "<a href='login.php'><p style='text-align:center;'> Sign in to write a comment </p></a>";

        $sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments`";
        $query = $con->query($sql);


        while ($row = mysqli_fetch_assoc($query))
        {
            echo "<div class='container'>";
            echo "<div class='col-lg-4'></div>";
            echo "<div class='col-lg-4' style='margin-top:5%;'>";
            echo "<p>Name: " . $row['name'] . "</p>";
            echo "<p>Comment: " . $row['comment'] . "</p>";
            echo "<p>Time: " . $row['time'] . "</p>";
            echo "</div>";
            echo "<div class='col-lg-4'></div> ";
            echo "</div>";
        }
    }
?>

Answer 1

The issue is either A: You have no id column in your database and so the error is being thrown when you are trying to select the id with this line:

`$sql = "SELECT `id`, `name`, `comment`, `time` FROM `comments`";`

Potential issue B: Your id column is set as a primary key in your DB. This means that the id column automatically increments by 1 for each record that's inserted. But when you're inserting your new row you're trying to set the id to NULL:

$sql = "INSERT INTO `comments`(`id`, `name`, `comment`, `time`) VALUES (NULL,'$name','$comment',CURRENT_TIMESTAMP)";

Try changing it to this:

$sql = "INSERT INTO `comments`(`name`, `comment`, `time`) VALUES ('$name','$comment',CURRENT_TIMESTAMP)";

Potential issue C (most likely): You're not setting the $_GET['id'] parameter when loading your page. This is essentitally the ?id=x that you see in so many URLs.

Also as other people have mentioned, your query is injectable, I know you said this is only local but it's good to get into good habits from the off.