php中的网上银行代码[关闭]

Question

$result = mysql_query("SELECT * FROM customers WHERE loginid= $_POST['loginid'] AND accpassword= $_POST['accpassword']");

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in C:\wamp\www\index.php on line 6

Answer 1

Basic PHP syntax: You cannot use quoted array keys within a "-quoted string:

$value = "$array['key']"; // bad
$value = "$array[key]"; // ok
$value = "{$array['key']}"; //ok, alternate syntax

You are also vulnerable to SQL injection attacks. This is EXTRAORDINARLY bad since you say this is for online banking code...