我应该使用哪个PHP函数来调用动态页面的ID？

Question

I'm creating a news website, and want to create a dynamic PHP page that will have the header and footer, and get the content itself (title and text) from the database by calling the article's id via the URL(like 'article.php?id=1'), so that there is no need for creating a new file for each article. However, I don't know what function should I use to make that work. Currently, the code is like this:

<?php

    include "header.php";

        $query = "SELECT title_article, subtitle_article, content_article FROM tb_article WHERE id_tb_article = 1";

        $conn = mysqli_connect('127.0.0.1:3307', 'root', '', 'article') or die("error");

        $result = mysqli_query($conn, $query);

        if (mysqli_num_rows($result) > 0) {
        // output data of each row
        while($row = mysqli_fetch_assoc($result)) {
            echo "<div class='titlediv'><h1 class='title'>" . $row["title_article"]. "</h1></div><div class='titlediv'><h3 class='title'>". $row["subtitle_article"]. "</h3></div><div class='textdiv'><p class='text'>" . $row["content_article"]. "</p></div><br>";
        }

        } else {
            echo "Article not found";
        }

    include "footer.php";

?>

Answer 1

To get the id value from query string in URL, you can use the PHP's superglobal $_GET['id'] .

To select a dynamic value from SQL using this value you must use prepared statements with parameter binding.

Your code with all the fixes would look more or less like this:

<?php

include "header.php";

$query = "SELECT title_article, subtitle_article, content_article FROM tb_article WHERE id_tb_article = 1";

// Enable mysqli error reporting and NEVER die()
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
$conn = new mysqli('127.0.0.1:3307', 'root', '', 'article');
$conn->set_charset('utf8mb4'); // You should always specify the correct charset, which most of the time should be utf8mb4

// prepare -> bind -> execute -> get result
$stmt = $conn->prepare('SELECT title_article, subtitle_article, content_article 
    FROM tb_article 
    WHERE id_tb_article = ? ');
$stmt->bind_param('i', $_GET['id']);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows) {
    // output data of each row
    foreach ($result as $row) {
        echo "<div class='titlediv'><h1 class='title'>" . htmlspecialchars($row["title_article"]). "</h1></div>";
        echo "<div class='titlediv'><h3 class='title'>". htmlspecialchars($row["subtitle_article"]). "</h3></div>";
        echo "<div class='textdiv'><p class='text'>" . htmlspecialchars($row["content_article"]). "</p></div><br>";
    }
} else {
    echo "Article not found";
}

include "footer.php";

Whenever output values into HTML context always do it via htmlspecialchars

Answer 2

You can use a GET method and the url look like 'article.php?id=2'.

<?php

include "header.php";

    //use GET to get the id
    $id = $_GET["id"];
    // use .$id to concat to the query
    $query = "SELECT title_article, subtitle_article, content_article FROM tb_article WHERE id_tb_article = ".$id;

    $conn = mysqli_connect('127.0.0.1:3307', 'root', '', 'article') or die("error");

    $result = mysqli_query($conn, $query);

    if (mysqli_num_rows($result) > 0) {
    // output data of each row
    while($row = mysqli_fetch_assoc($result)) {
        echo "<div class='titlediv'><h1 class='title'>" . $row["title_article"]. "</h1></div><div class='titlediv'><h3 class='title'>". $row["subtitle_article"]. "</h3></div><div class='textdiv'><p class='text'>" . $row["content_article"]. "</p></div><br>";
    }

    } else {
        echo "Article not found";
    }

include "footer.php";

?>

Answer 3

You want to look at the global variables $_GET and $_POST. In your example ('article.php?id=1') you will find the value of 'id' in $_GET['id'].

URL: article.php?id=42

echo $_GET['id']; // Outputs 42

Remember that anyone can change that value in the URL and even injecting malicious queries into your query. Its better to at least cast your id to an integer first and use always mysqli_real_escape_string() for URL given variables in the query.

URL: article.php?id=42;DROP TABLE tb_article

echo $_GET['id']; // Outputs "42;DROP TABLE tb_article", would delete your table when used directly

// Convert to an integer value
$id = intval($_GET['id']); // Returns 42
$query = "... FROM tb_article WHERE id_tb_article = ".mysqli_real_escape_string($id);