SELECT: WHERE子句的校验值

Question

我正在尝试在选定的汽车之间创建一个比较选项。

<?php
if(isset($_POST['compares'])) {
$id_nums = array($_POST['cBox']);
//$id_nums = array(1,6,12,18,24);
$id_nums1 = implode(", ", $id_nums);

$query = "SELECT * FROM wp_cars WHERE id in ($id_nums1)";
$cCars = mysql_query($query) or mysql_error();

while($car = mysql_fetch_array($cCars)) {
    echo $car['cartitle']."<br/>";
    echo $car['saleprice']."<br/>";
}
} else {
$query1 = "SELECT * FROM wp_cars";
$allcars = mysql_query($query1) or die(mysql_error());  `

while($car1 = mysql_fetch_array($allcars)) {
    echo "<input type='checkbox' value=".$car1['id']." name='cBox[]' />";
    echo $car1['cartitle']."<br/>";
    echo $car1['saleprice']."<br/>";
}

}
?>

如何根据复选框选择传递复选框名称(cBox[])数组。

<form action="compares.php" method="post">
<button name="compares">Select Cars to Compare</button>
</form>

Answer 1

$id_nums = array($_POST['cBox']);

$_POST['cBox']已经是一个数组，您正在创建一个二维数组。正在做什么

$id_nums1 = implode(", ", $_POST['cBox']);

会做你想做的事。尽管它对SQL注入是开放的。

Answer 2

从你的超文本标记语言部件发送，这样发送输入：

<form action="compares.php" method="post">
<?php foreach (mysql_fetch_array($allcars) as $car: ?>
    <input type="checkbox" value="<?php echo $car['id']; ?>" name="cBox[]" />
    <?php echo $car['cartitle']; ?><br />
    <?php echo $car['saleprice']; ?><br />
<?php endforeach; ?>
</form>

在您的部分中，以如下方式接收输入：

$id_nums = implode(",", $_POST['cBox']);