在一个process.php文件中提交第二次查询之前，如何查询SQL数据库？

Question

I have a process booking script which takes information from a HTML booking form and sends it to a mySQL relational database. 我有一个流程预订脚本，该脚本从HTML预订表单获取信息，并将其发送到mySQL关系数据库。

It worked fine, however I have modified the code so that the first query checks to see whether the room they have selected is booked at any time during the date range they have specified. 它工作正常，但是我修改了代码，以便第一个查询检查以查看他们选择的房间是否在他们指定的日期范围内的任何时间被预订。 This can be seen in the first query $q 可以在第一个查询$ q中看到

If it is already booked on any of the days the user submitted for that room, the script should echo an error, else it should fire the mysqli_multiquery and submit the data. 如果用户在该房间提交的任何一天都已经预订了该脚本，则脚本应回显错误，否则应触发mysqli_multiquery并提交数据。

Both of these queries work directly in sql, however I am having trouble figuring out why the initial if statement does not work - 'if(mysqli_num_rows($result) == 0)'. 这两个查询都直接在sql中工作，但是我很难弄清楚为什么最初的if语句不起作用-'if（mysqli_num_rows（$ result）== 0）'。

Here is the PHP file: 这是PHP文件：

******** EDIT ********** ********编辑**********

When I submit a booking for a room that already prebooked for the requested date range, it is submitted instead of echoing the content in the else statement. 当我为已经在请求的日期范围内进行了预定的房间提交预订时，将提交该预订，而不是回显else语句中的内容。

Here are the error messages: 这是错误消息：

Error messages displayed 显示的错误信息

******** EDIT TWO ********** ********编辑两个**********

Fixed! 固定！ The problem was with a bad query. 问题出在查询错误。

<html>



<body>

    <?php

        $page_title = 'Process Booking Form';

        require 'login-db.php';   //  require once means that it well generate a fatal error if the file is not found and means that the file will only be read in when it has not previously been inclued which prevents wastefule duplicate disk accesses.

         $dbc = new mysqli($hn, $un, $pw, $db);



        if($dbc->connect_error) {

           die ($dbc->connect_error);

        }



        if(isset($_POST['firstname']) &&

           isset($_POST['lastname']) &&

           isset($_POST['datefrom']) &&

           isset($_POST['dateto']) &&

           isset($_POST['specialevent']) &&

           isset($_POST['roomnumber']))

        {

            $firstname     = secure_post($dbc, 'firstname');

            $lastname      = secure_post($dbc, 'lastname');   //security

            $datefrom      = secure_post($dbc, 'datefrom');

            $dateto        = secure_post($dbc, 'dateto');

            $specialevent  = clean_string($dbc, 'specialevent');

            $roomno        = secure_post($dbc, 'roomnumber');



                //validation



                $error_message = "";



                if(strlen($firstname) < 2 || strlen($firstname) > 20) {

                    $error_message .= 'Your first name does not appear to be valid.<br>';

                }



                if(strlen($lastname) < 2 || strlen($lastname) > 30) {

                    $error_message .= 'Your last name does not appear to be valid.<br>';

                }



                if(strlen($error_message) > 0) {

                    die($error_message);

                }


                //Query to find out if user selected dates are already booked for their chosen room
                $q = "SELECT customerinfo.firstname, customerinfo.lastname, roominfo.roomnumber, roominfo.roomsize, roominfo.roomprice, bookings.datefrom, bookings.dateto, bookings.daterange

                FROM customerinfo

                LEFT JOIN bookings ON bookings.customer_id = customerinfo.customer_id

                LEFT JOIN transactions ON customerinfo.customer_id = transactions.customer_id

                LEFT JOIN transactionsdetails ON transactionsdetails.transactions_id = transactions.transactions_id

                LEFT JOIN roominfo ON transactionsdetails.room_id = roominfo.room_id

                WHERE roomnumber = $roomno

                AND (bookings.datefrom BETWEEN $datefrom AND $dateto)

                OR (roomnumber = $roomno

                AND (bookings.dateto BETWEEN $datefrom AND $dateto))";

                $result = mysqli_query($dbc, $q);

                // $checkdates = mysqli_query($dbc, $checkdatessql);

                if(mysqli_num_rows($result) == 0) {

                        //echo confirmation message to user
                        echo "Hello $firstname, your booking has been requested for room: $roomno. Your check-in date and time is $datefrom at 11:00am and your scheduled checkout date and time is $dateto at 15:00pm. Thank you for choosing to stay at Westworld.";

                        //submit customer information to the database
                        mysqli_multi_query($dbc,

                         "INSERT INTO customerinfo(firstname, lastname, specialevent) VALUES ('$firstname','$lastname','$specialevent');

                        SET @cusID := LAST_INSERT_ID();

                        INSERT INTO bookings(dateto, datefrom, daterange, customer_id) VALUES ('$dateto','$datefrom',DATEDIFF(dateto,datefrom), @cusID);

                        INSERT INTO transactions (customer_id, datebooked) VALUES (@cusID, CURDATE());

                         SET @roomID := (SELECT room_id FROM roominfo WHERE roomnumber = '$roomno');

                        INSERT INTO transactionsdetails (transactions_id, room_id) VALUES (LAST_INSERT_ID(), @roomID);");
                } else {
                  //echo room error message
                  echo "The room you have selected is unavailable in that date range.";
                }


            $r->close();

            $dbc->close();


        };



        function secure_post($dbc, $string) {

            return htmlentities($dbc->real_escape_string($_POST[$string]));

        } 



        function clean_string($dbc, $string) {

            if (get_magic_quotes_gpc())  $string = stripslashes($string);

            return htmlentities($dbc->real_escape_string($_POST[$string]));

        }


    ?>



</body>

Answer 1

Well, add a "print_r(mysqli_num_rows($result));" 好吧，添加一个“ print_r（mysqli_num_rows（$ result））;” and see what comes out. 看看结果如何。 It may return a string, as mentioned in the documentation. 如文档中所述，它可能返回一个字符串。 I don't know what you use in your $datefrom and other variables, which you are using within your querys without any escaping ( great idea ) but when it is a valid date ('YYYY-MM-DD'), then you need to escape it. 我不知道您在$ datefrom和其他变量中使用了什么，您在查询中使用了这些变量而没有任何转义（很好的主意），但是当它是有效日期（'YYYY-MM-DD'）时，则需要逃脱它。

Whatever it is, you should REALLY switch to PDO. 无论是什么，您都应该真正切换到PDO。 there you can use prepared statements and let PDO map the variables for you (you still write the same SQL-command but instead of "$test" you write ":test" and then say ":test should be replaced by $test and it's a string"). 在那里，您可以使用准备好的语句，并让PDO为您映射变量（您仍然编写相同的SQL命令，但是您可以使用“：test”而不是“ $ test”，然后说“：test应该由$ test代替，它是一个字符串”）。 MUCH safer and companies won't fire you on the spot ;) 更安全，公司不会当场解雇您；）

Next time try to keep the code simple like one simple select-query, then the mysqli_num_rows, then one return and nothing else. 下次尝试使代码保持简单，如一个简单的选择查询，然后是mysqli_num_rows，然后是一个返回，而没有其他。 Don't post more than you need to for people to understand your problem. 发布的内容不要过多，以使人们理解您的问题。

在一个process.php文件中提交第二次查询之前，如何查询SQL数据库？

问题描述

1 个解决方案

解决方案1
0 2018-06-13 10:17:28

在一个process.php文件中提交第二次查询之前，如何查询SQL数据库？

问题描述

1 个解决方案

解决方案1 0 2018-06-13 10:17:28

解决方案1
0 2018-06-13 10:17:28