苗条的框架，不显示任何输出

Question

I'm trying to get a json file using Slim Framework. The code I'm trying is mentioned below

$app->get('/forum/:id', function ($id) {
$user_name = "abc";
$password = "123";
$database = "test";
$server = "localhost";

$db_handle = mysqli_connect($server, $user_name, $password);
mysqli_set_charset($db_handle, "utf8");
mysqli_select_db($db_handle, $database);

$arr = array();
    $SQL = "Select y123_forum.post_id, y123_forum.posttext  FROM y123_forum INNER JOIN y123_users ON y123_forum.user_id = y123_users.id WHERE type = 1 AND y123_users.email = 'id'";

$result = mysqli_query($db_handle, $SQL);
while ($row = mysqli_fetch_assoc($result))
    {
         array_push($arr, $row);
    }
mysqli_close($db_handle);
echo json_encode($arr);
 });

The output displayed on the browser is []

When I try the above code without passing parameter, ie

$app->get('/faqs/', function () {
$user_name = "abc";
$password = "123";
$database = "test";
$server = "localhost";

$db_handle = mysqli_connect($server, $user_name, $password);
mysqli_set_charset($db_handle, "utf8");
mysqli_select_db($db_handle, $database);


$arr = array();
$SQL = Select y123_forum.post_id, y123_forum.posttext  FROM y123_forum INNER JOIN y123_users ON y123_forum.user_id = y123_users.id WHERE type = 1 AND y123_users.email = 'abc@gmail.com'"

$result = mysqli_query($db_handle, $SQL);
while ($row = mysqli_fetch_assoc($result))
    {
        array_push($arr, $row);
    }
mysqli_close($db_handle);
echo json_encode($arr);

});

then it works fine

How do i fix this, I need to get this working to get the json file by passing any email id's from the database

Answer 1

You're forgetting the $ in the parameter, it thinks you're looking for an email address of 'id', not the contents of $id.

SELECT * FROM y123_forum WHERE email = '$id';

Note that this is a horrible, bad, unsafe way to pass parameters to a SQL query. The correct way would be to parameterize your query and execute this way:

$SQL = 'SELECT * FROM y123_forum WHERE email = ?';
$stmt = mysqli_stmt_init($db_handle);  
if (mysqli_stmt_prepare($stmt, $sql)) {
    mysqli_stmt_bind_param($stmt, 's', $id);

    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);
    while ($row = mysqli_fetch_assoc($result))
    {
       array_push($arr, $row);
    }
}

The 's' in mysql_stmt_bind_param tells the driver your $id variable should be treated as a string, and escapes it appropriately.