php - 使用 PHP 选择框选择具有特定数值的 SQL 字段

Question

提前感谢您的帮助，我对编写代码还很陌生。我正在尝试使用选择列表来选择特定日期，并从该日期开始打印注册人员的姓名列表。当它们已注册时，数据库的值为 1；如果未注册，则数据库的值为 0。尝试处理输入的日期并在数据库中选择具有适当值的名称时出现了困难。感谢您的任何反馈，并对任何明显的错误提前表示歉意!

<form name="whoplaying" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
    <select name="playdate">
       <option value="playdate1"> September 3, 2014 </option>
       <option value="playdate2"> September 6, 2014 </option>
       <option value="playdate3"> September 10, 2014 </option>
       <option value="playdate4"> September 13, 2014 </option>
       <option value="playdate5"> September 17, 2014 </option>
    </select>
       <input type="submit" value="Select Playdate">

<?php

$host = 'localhost';
$username = '#####';
$password = '#####';
$db_name = 'signuplist';
$tbl_name = 'signupbydate';
$myusername=$_SESSION['logname']; 

$cxn=mysqli_connect($host,$username,$password,$db_name)
     or die ("Couldn't Connect to Server");

     if(isset($_POST['submit']))
     {   
         $playdate = $_POST['playdate'];

         $stmt = mysqli_stmt_init($cxn);
           if (mysqli_stmt_prepare($stmt, 'SELECT username FROM $tbl_name WHERE $playdate=?')) {

           /* bind parameters for markers */
           mysqli_stmt_bind_param($stmt, "s", $playdate);

           /* execute query */
           mysqli_stmt_execute($stmt);

           /* bind result variables */
           $result=mysqli_stmt_bind_result($stmt, $playdate);

           /* fetch value */
              while   ($row=mysqli_stmt_fetch($result));
               {                       
                 echo "<table border='1'>
             <table class='center'>
         <tr>
             <th><div style=width:100px>Username</div></th>
                 </tr>";

             extract ($row);
             echo"<tr>\n
             <td>$username</td>
             </tr>\n";
              }
           echo "</table>"; 

           mysqli_stmt_close($stmt);  }    

     mysqli_close($cxn);

    }
?>

Answer 1

您的表单定义错误。应该是

<select name="playdate">
   <option value="Sep 3, 2014">Sep 3, 2014</option>
   <option value="Sep 6, 2014">Sep 6, 2014</option>
   etc...
</select>

$playdate = $_POST['playdate']; // $playdate becomes "Sep 3, 2014"

此外，您很容易受到 SQL injection attacks 的攻击，因此请停止处理此代码，直到您学会如何避免这种情况。