与排列勾选框有关的问题

Question

我正在做一个PHP表单，需要填写字段-有一节关于编辑申请表中的字段由冲浪者在表单提交后…

技能集是在原始页面中勾选的，但当涉及到编辑技能集时，我键入的代码显示了与原始页面不同的排列顺序。

以下是原始应用程序页面，在选中复选框之后，但在提交和潜在的表单编辑之前，会立即显示复选框：

​

如果申请者想要编辑字段，则在提交字段并由服务器将其处理到数据库中后，这是应用程序页面。他们完全处于无序状态！

​

我希望第二个图像生成一个复选框列表，就像应用程序正在完成时的第一个一样。

这些字段是从名为skillset的数据库表中选择或检索的，并与从该表插入到另一个名为emprecords的表中的值进行比较。通过在emprecords表中运行for循环，我能够回显或打印出特定申请者插入的技能集列表(在emprecords数据库中使用逗号分隔每个技能的字符串之后)，但我无法为Array中的技能列表以正确的顺序打印选中的复选框。我希望上面的图片能有所帮助。以下是在网站上编辑申请者字段的页面的PHP代码：

<br><br><H2 align="center">SKILLS SET</H2>
<br>
<label for="skills" size="3">Pick Your Skill(s): </label>
<br><br>
<tr>

<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    <tr>
        <td valign="top">
        <?php

        $id = $_GET["id"];

        $query2 = "SELECT * FROM emprecords WHERE id ='$id'";
        $record_set2 = $dbs->prepare($query2);
        $record_set2 -> execute();
        $row2 = $record_set2->fetch(PDO::FETCH_ASSOC);
        $sk = $row2['skills'];
        $skills1 = explode(",", $sk);
        for ($i=0; $i< count($skills1); $i++) {
            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills1'checked>$skills1[$i]<br>"; 
        }

        $list = "
        SELECT *
        FROM skillsset
        WHERE category='Engineering'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();

        if(!isset($_POST['submitd'])) {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
            {
                $skills = $row["skills"];
                echo "
                <form action='' method='post'>
                <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";
            }
        }
        else {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
                $skills = $row["skills"]; 
                if(strlen($skills)>0){
                    if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {
                        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
                    }
                    if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])){
                        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                    } else {
                        if(!in_array($skills, $_POST['skills'])) {
                            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                        } 
                    }
                }
                echo "</form>";
            }
        }
        ?>
        </td>
        <td valign="top">
        <?php
        $list = "
        SELECT *
        FROM skillsset
        WHERE category='Information'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();


        if(!isset($_POST['submitd'])){
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
            {
                $skills = $row["skills"];
                echo "
                <form action='' method='post'>
                <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";

            }
        }
        else {
            while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
                $skills = $row["skills"];
                if(strlen($skills)>0) { 
                    if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {

                    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
                    }
                    if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])) {

                    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                    } else {
                        if(!in_array($skills, $_POST['skills'])){
                            echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
                        }
                    }
                }
                echo "</form>";
            }
        }
        ?>
        </td>
    </tr>
</table>

请试着帮我解决这个难题。

Answer 1

必选链接：Your code is open to SQL injection

让我们从小事做起。

您可能希望将Skills Set更改为Skill Set (请参见？从小做起：)

在<td>Information Technologies</td>之后，您缺少一个结束的</tr>

您正在执行以下操作：

if(!isset($_POST['submitd'])) {
    while($row = $listAHI ->fetch(PDO::FETCH_ASSOC))
    {
        $skills = $row["skills"];
        echo "
        <form action='' method='post'>
        <input type='checkbox' id='skills' name='skills[]' value='$skills'>  $skills<br> ";
    }
}
else ...

在这里，您为每个输入回显一个新的<form>，但只在else中关闭表单。忘记这一点，然后将<form>放在整个表的周围。

<form method='POST' action=''>
<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    </tr>
    <tr>
        <td valign="top">
        ...
</table>
</form>

此外，不清楚下面的代码做了什么，我花了几次阅读才得到它。我为自己这样做感到内疚，但我想建议您在代码复杂时尝试注释代码的意图。

if(isset($_POST['skills']) and in_array($skills, $_POST['skills'])) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' checked>$skills<br>";
}
if(isset($_POST['skills']) and !in_array($skills, $_POST['skills'])) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
} else if(!in_array($skills, $_POST['skills'])) {
        echo "<input type='checkbox' id='skills' name='skills[]' value='$skills' unchecked>$skills<br>";
    } 
}

注意，前面描述了实际问题

以下代码就是问题所在

$id = $_GET["id"];

$query2 = "SELECT * FROM emprecords WHERE id ='$id'";
$record_set2 = $dbs->prepare($query2);
$record_set2 -> execute();
$row2 = $record_set2->fetch(PDO::FETCH_ASSOC);
$sk = $row2['skills'];
$skills1 = explode(",", $sk);
for ($i=0; $i< count($skills1); $i++) {
    echo "<input type='checkbox' id='skills' name='skills[]' value='$skills1'checked>$skills1[$i]<br>"; 
}

由于您使用所选技能的值回显<input>，因此将显示两次复选框。

如果您想要选中员工(从名字emprecords中猜测它是employee )之前选择的技能的复选框，那么您应该将技能放在一个数组中，并在echo out复选框时选中该数组。

为了简化你的代码，下面的代码做的远不止这些。您应该能够使用它替换您发布的所有代码。也要知道，有几种方法可以做你想做的事情。我把它留给你去寻找最优的解决方案。

<br><br><H2 align="center">SKILL SET</H2>
<br>
<label>Pick Your Skill(s):</label>
<br><br>

<table border='1' cellspacing='0'>
    <colgroup>
        <col span='1'>
    </colgroup>
    <tr>
        <td>Engineering Services</td>
        <td>Information Technologies</td>
    </tr>
    <tr>
<?php
    $empSkills = array();
    if(isset($_GET['id'])) {

        $id = $_GET["id"];

        // use this try catch to catch potential errors
        try {
            // note how $query2 has :id at the end. Using ->prepare() and ->execute(with array parameter) is one good way to protect yourself from SQL injection attacks
            // also, only pull the columns that you're going to actually use
            $query2 = "SELECT skills FROM emprecords WHERE id =:id";
            $record_set2 = $dbs->prepare($query2);
            $record_set2 -> execute(array(':id'=>$id));
            $row2 = $record_set2->fetch(PDO::FETCH_ASSOC);

            $sk = $row2['skills'];
            $empSkills = explode(",", $sk);

            // always perform clean-up
            $record_set2->closeCursor();
        } catch (PDOException $e) { // always perform error checking on PDO
            // print whatever error messages you feel appropriate
            print "Error!: " . $e->getMessage() . "<br/>";
            die(); // stop executing the script on error (up to you)
        }
    }
    // CHAR_LENGTH() is a MySQL function that returns the number of characters in the string passed to it
    try {
        $list = "
        SELECT skills
        FROM skillsset
        WHERE CHAR_LENGTH(skills) > 0 AND category='Engineering'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();
        // this is a function. it is defined below
        printSkillsTd($listAHI, $empSkills);
        $listAHI->closeCursor();
    } catch (PDOException $e) {
        print "Error!: " . $e->getMessage() . "<br/>";
        die();
    }

    try {
        $list = "
        SELECT skills
        FROM skillsset
        WHERE CHAR_LENGTH(skills) > 0 AND category='Information'
        ORDER BY skills ASC";
        $listAHI = $dbs ->prepare($list);
        $listAHI -> execute();

        printSkillsTd($listAHI, $empSkills);
        $listAHI->closeCursor();
    } catch (PDOException $e) {
        print "Error!: " . $e->getMessage() . "<br/>";
        die();
    }

/**
 * This function prints out the all skills in the PDOStatement $listAHI as checkboxes. It "checks" the checkbox if the skill is in $empSkills
 */
function printSkillsTd($listAHI,$empSkills) {
    echo '
            <td valign="top">';

    while($row = $listAHI ->fetch(PDO::FETCH_ASSOC)) {
        $skill = $row['skills'];

        // note how i left out the 'id' attribute. The id attribute of an element must be unique on the entire page. You could make the `id` something like `skill_$skill` but i don't see why you would need an `id` at all from the posted code
        echo "
                <label><input type='checkbox' name='skills[]' value='$skill'";
        if(in_array($skill,$empSkills))
            echo " checked";
        echo ">$skill</label><br>";
    }

    echo '
            </td>';
}
        ?>
    </tr>
</table>