SQLの高度な検索/空のクエリを無視する

Question

私は検索するために私のウェブサイト上で高度な検索機能を作成しています。私は特定のアカウント（姓、名字、ユーザー名、登録日、アカウントのランク）を検索するために使用できる5つのフィールドを持っており、すべてのフィールドのオプションが一致しなければならないか、1つ以上のフィールドが一致しなければなりません。ユーザーが入力した値は、Javascriptを介してPHPファイルに送られます。 PHPファイルが検索を完了します。

現在、「AND」検索は空白の値として動作しますが、他の値は一致する必要があるため、検索の結果には影響しません。しかし、 "OR"は、空の検索ボックスが "LIKE％"と一致するので、他のレコードを表示させません。$変数。変数がブランクのときに "％"検索。

私はシステムが空のボックスを無視する方法を理解する必要がありますが、私は間違った場所で "OR"が使用されているSQLコードでエラーを引き起こさずに動作する適切な方法を見つけるのに苦労しています。だから、どんな提案もいいだろう。これは、おそらくこれまで完璧からです事前に

おかげで、 トム

PHP

<?php 
//Retrieves variables from Javascript. 
$Surname = $_POST["Surname"]; 
$Forename = $_POST["Forename"]; 
$Username = $_POST["Username"]; 
$Joined = $_POST["Joined"]; 
$Rank = $_POST["Rank"]; 
$ANDOR = $_POST["ANDOR"]; 

$data = 0; 

include "db/openlogindb.php"; 
if($DBError == true){ 
    $data = 3; 
} 
else{ 

    if($ANDOR == "AND"){ 
     $UserSearch = "SELECT username, surname, forename, joined, rank FROM users 
     WHERE surname LIKE '%".$Surname."%' 
     AND forename LIKE '%".$Forename."%' 
     AND username LIKE '%".$Username."%' 
     AND joined LIKE '%".$Joined."%' 
     AND rank LIKE '%".$Rank."%' 
     ORDER BY surname"; 
    } 
    else if($ANDOR == "OR"){ 
     $UserSearch = "SELECT username, surname, forename, joined, rank FROM users 
     WHERE surname LIKE '%".$Surname."%' 
     OR forename LIKE '%".$Forename."%' 
     OR username LIKE '%".$Username."%' 
     OR joined LIKE '%".$Joined."%' 
     OR rank LIKE '%".$Rank."%' 
     ORDER BY surname"; 
    } 
    else{ 
     $data = 2; 
    } 

    if($data == 0){ 
     $results = mysqli_query($conn, $UserSearch); 

     if(mysqli_num_rows($results) == 0){ 
      $data = 1; 
     } 
     else{ 
      $data = ''; 

      while($row = mysqli_fetch_assoc($results)){ 
       $data .= '<tr><td>'.$row['surname'].'</td><td>'.$row['forename'].'</td><td>'.$row['username'].'</td><td>'.$row['joined'].'</td><td>'.$row['rank'].'</td><td><button type="button" class="btn btn-block btn-primary btn-xs" onClick="ChangePassOpen(\''.$row['username'].'\')">Change Password</button></td></tr>'; 
      } 
     } 
    } 
} 

include "db/closelogindb.php"; 

echo $data; 
?> 

HTML/Javascriptの http://thomas-smyth.co.uk/admin/accountlist.php

Answer 1

<?php 
// Create the array to store the variables 
$array = array(); 

//Retrieves variables from Javascript. 
//Where $conn is your database connection 
if (isset($_POST["Surname"])) $array['surname'] = mysqli_real_escape_string($conn, $_POST["Surname"]); 
if (isset($_POST["Forename"])) $array['forename'] = mysqli_real_escape_string($conn, $_POST["Forename"]); 
if (isset($_POST["Username"])) $array['username'] = mysqli_real_escape_string($conn, $_POST["Username"]); 
if (isset($_POST["Joined"])) $array['joined'] = mysqli_real_escape_string($conn, $_POST["Joined"]); 
if (isset($_POST["Rank"])) $array['rank'] = mysqli_real_escape_string($conn, $_POST["Rank"]); 
if (isset($_POST["ANDOR"])) $ANDOR = mysqli_real_escape_string($conn, $_POST["ANDOR"]); 

$data = 0; 

include "db/openlogindb.php"; 
if($DBError == true){ 
    $data = 3; 
} 
else{ 

//Make a variable to check for the last key in the array 
$last_key = end(array_keys($array)); 

if($ANDOR == 'AND'){ 
     $UserSearch = "SELECT "; 
     foreach ($array as $key => $value) 
       { 
        $UserSearch .= $key; 
        if ($last_key != $key) $UserSearch .= ', '; 
       } 
       $UserSearch .= ' FROM users WHERE '; 

       foreach ($array as $key => $value) 
       { 
        $UserSearch .= $key . ' LIKE %"' . $value . '"%'; 
        if ($last_key != $key) $UserSearch .= ' AND '; 
       } 
     } 
    else if($ANDOR == 'OR'){ 
     $UserSearch = "SELECT "; 
     foreach ($array as $key => $value) 
       { 
        $UserSearch .= $key; 
        if ($last_key != $key) $UserSearch .= ', '; 
       } 
       $UserSearch .= ' FROM users WHERE '; 

       foreach ($array as $key => $value) 
       { 
        $UserSearch .= $key . ' LIKE %"' . $value . '"%'; 
        if ($last_key != $key) $UserSearch .= ' OR '; 
       } 
     } 
    else{ 
     $data = 2; 
    } 

    if($data == 0){ 
     $results = mysqli_query($conn, $UserSearch); 

     if(mysqli_num_rows($results) == 0){ 
      $data = 1; 
     } 
     else{ 
      $data = ''; 

      while($row = mysqli_fetch_assoc($results)){ 
       $data .= '<tr><td>'.$row['surname'].'</td><td>'.$row['forename'].'</td><td>'.$row['username'].'</td><td>'.$row['joined'].'</td><td>'.$row['rank'].'</td><td><button type="button" class="btn btn-block btn-primary btn-xs" onClick="ChangePassOpen(\''.$row['username'].'\')">Change Password</button></td></tr>'; 
      } 
     } 
    } 
} 

include "db/closelogindb.php"; 

echo $data; 
?> 

Answer 2

は、しかし、それは仕事をしません。私は一度それを読んだら、SQLインジェクション保護を追加するつもりです。

<?php 
//Retrieves variables from Javascript. 
$Surname = $_POST["Surname"]; 
$Forename = $_POST["Forename"]; 
$Username = $_POST["Username"]; 
$Joined = $_POST["Joined"]; 
$Rank = $_POST["Rank"]; 
$ANDOR = $_POST["ANDOR"]; 

if($Surname == ""){ 
    $Surname = "xxxxxxxxxx"; 
} 
if($Forename == ""){ 
    $Forename = "xxxxxxxxxx"; 
} 
if($Username == ""){ 
    $Username = "xxxxxxxxxx"; 
} 
if($Joined == ""){ 
    $Joined = "xxxxxxxxxx"; 
} 
if($Rank == ""){ 
    $Rank = "xxxxxxxxxx"; 
} 

$data = 0; 

include "db/openlogindb.php"; 
if($DBError == true){ 
    $data = 3; 
} 
else{ 

    if($ANDOR == "AND"){ 
     $UserSearch = "SELECT username, surname, forename, joined, rank FROM users 
     WHERE surname LIKE '%".$Surname."%' 
     AND forename LIKE '%".$Forename."%' 
     AND username LIKE '%".$Username."%' 
     AND joined LIKE '%".$Joined."%' 
     AND rank LIKE '%".$Rank."%' 
     ORDER BY surname"; 
    } 
    else if($ANDOR == "OR"){ 
     $UserSearch = "SELECT username, surname, forename, joined, rank FROM users 
     WHERE surname LIKE '%".$Surname."%' 
     OR forename LIKE '%".$Forename."%' 
     OR username LIKE '%".$Username."%' 
     OR joined LIKE '%".$Joined."%' 
     OR rank LIKE '%".$Rank."%' 
     ORDER BY surname"; 
    } 
    else{ 
     $data = 2; 
    } 

    if($data == 0){ 
     $results = mysqli_query($conn, $UserSearch); 

     if(mysqli_num_rows($results) == 0){ 
      $data = 1; 
     } 
     else{ 
      $data = ''; 

      while($row = mysqli_fetch_assoc($results)){ 
       $data .= '<tr><td>'.$row['surname'].'</td><td>'.$row['forename'].'</td><td>'.$row['username'].'</td><td>'.$row['joined'].'</td><td>'.$row['rank'].'</td><td><button type="button" class="btn btn-block btn-primary btn-xs" onClick="ChangePassOpen(\''.$row['username'].'\')">Change Password</button></td></tr>'; 
      } 
     } 
    } 
} 

include "db/closelogindb.php"; 

echo $data; 
?>