PHP表格处理POST

Question

I'm trying to use form processing to make a specific database query. I set the form to $name and am trying to process $sql = "SELECT * FROM quotes WHERE qSymbol = $name ORDER BY qQuoteDateTime DESC" What is the best way to do this?

<form action="post.php" method="post">
<span></span><input type = "text" value=" " name="boxy" />
<br/><input type="submit" name="submit" value="Enter" />
</form>

<?php
    $name = $_POST['boxy'];
    if(isset($_POST['boxy'])){
        error_reporting(E_ALL ^ E_DEPRECATED);

        $con = mysql_connect('...');
        if (!$con){
            die("Cannot connect : " . mysql_error());
        }
        mysql_select_db('quotesdb',$con);
        $sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC";
        $myData = mysql_query($sql,$con);
        echo "<table border = 1>
        <tr>
        <th>Data</th>
        <th>Last</th>
        <th>Change</th>
        <th>% Chg</th>
        <th>Volume</th>
        </tr>";

        while ($record = mysql_fetch_array($myData)){
            echo "<tr>";
            echo "<td>" . $record['qQuoteDateTime'] . "</td>";
            echo "<td>" . $record['qLastSalePrice'] . "</td>";
            echo "<td>" . $record['qNetChangePrice'] . "</td>";
            echo "<td>" . $record['qNetChangePct'] . "</td>";
            echo "<td>" . $record['qShareVolumeQty'] . "</td>";
            echo "</tr>";

        echo "</table>";



        mysql_close($con);




        }

Answer 1

除非变量是数字，否则仍然需要在变量周围加上单引号

$sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC";