這是測試代碼,我知道 sql 注入以及如何修復(fù)它們。這是一個很長的問題要解釋,所以我會盡力而為。這些是我的數(shù)據(jù)庫中的列contentid (auto increments with every post, comment, and reply)hostid (gets the value of the person who uploaded the original post)postid (gets the value of the post, auto increments with every post)userid (gets the value of the person who commented or replied)date (gets the current time)title (gets the title of the post entered by the host)description (gets the description of the post entered by the host)fileid (describes the type of post ex. video, picture, or blog)commentid (auto increments with every comment)comment (the actual comment entered by a user)replyid (auto increments with every reply)reply (the actual reply entered by a user)我正在開發(fā)一個帖子系統(tǒng),該系統(tǒng)允許用戶發(fā)布內(nèi)容,然后對帖子發(fā)表評論或回復(fù)帖子中的評論。我有一個名為 posts 的數(shù)據(jù)庫,其中包含所有帖子的評論和回復(fù)。如果數(shù)據(jù)庫中沒有與帖子具有相同 postid 值的評論,則不應(yīng)回顯任何內(nèi)容。如果數(shù)據(jù)庫中沒有與之前評論具有相同 postid 和 commentid 的回復(fù),則不應(yīng)回顯任何內(nèi)容。換句話說,如果沒有評論或回復(fù),則不應(yīng)彈出任何內(nèi)容。我看到了實際的帖子,但我的數(shù)據(jù)庫中有評論和回復(fù)沒有顯示,有什么想法嗎?
1 回答

慕尼黑8549860
TA貢獻1818條經(jīng)驗 獲得超11個贊
看起來這部分... AND postid = 'postid' AND ...
應(yīng)該是... AND postid = '$postid' AND ...
您的查詢正在查找具有postid ==(字符串)“postid” 而不是 postid ==(值)$postid 的記錄,如您所愿。
- 1 回答
- 0 關(guān)注
- 111 瀏覽
添加回答
舉報
0/150
提交
取消