MySQL查询不关心用户输入之一

Question

So hey guys! I am currently working on a wordpress/woocommerce php code where the customer can make refund request through a few forms. I am almost done, but I have run in to a bit of a problem with the first part of the process.

The code below should take in the customers inputted order number, first name, and their post code, and check if there's an order with all of the same information in the database. However, right now it doesn't seem to care about the postcode, and whatever you write in to the postcode field, as long as the first two are correct, the user is let through to the next part.

Here I want to notify that in WooCommerce wp_postmeta table (where the customer data is fetched from), both the first name of the user and the post code are in the same column called "meta_value", hence I tried to make the below code, but it doesn't seem to be working.

<form action="" method="post" id="orderinfo">
<input type="text" placeholder="Tilausnumero" name="ordernmbr" required>
<input type="text" placeholder="Etunimi" name="firstname" required>
<input class="amountone" type="number" placeholder="Postinumero" name="postnmbr" required>
<input type="hidden" name="page" value="1">
<input type="submit" class="signupbtn" name="submit" value="Seuraava">
</form>

if(isset($_POST['submit'])) {
global $wpdb;
// Taking the user input into variables
$ordernumber = $_POST['ordernmbr'];
$orderfirstname = $_POST['firstname'];
$orderpostnumber = $_POST['postnmbr'];
$page = $_POST['page'];
// Sanitizing
$ordernumber = stripslashes_deep($ordernumber);
$orderfirstname = stripslashes_deep($orderfirstname);
$orderpostnumber = stripslashes_deep($orderpostnumber);

// Query that searches for order data from db
$sql = $wpdb->prepare("SELECT post_id FROM wp_postmeta
WHERE post_id = %d AND meta_key in ('_billing_first_name', '_billing_postcode')
and meta_value in ('%s', '%d')

group by post_id", $ordernumber, $orderfirstname, $orderpostnumber);

$res = $wpdb->get_results($sql, ARRAY_A);
}

Would anyone be able to show me where I'm going wrong, and show me how to do this correctly?

Thanks in advance.

Answer 1

Why not use the woocommerce build in functions?

$ordernumber = stripslashes_deep($ordernumber);
$orderfirstname = stripslashes_deep($orderfirstname);
$orderpostnumber = stripslashes_deep($orderpostnumber);

$args = array(
    'id' => $ordernumber,
    'billing_first_name' => $orderfirstname,
    'billing_postcode' => $orderpostnumber,
);
$orders = wc_get_orders( $args );
var_dump($orders);

Or even just use, get order - since the ID is unique? https://docs.woocommerce.com/wc-apidocs/function-wc_get_order.html