我正在尝试在线显示用户列表

Question

I am trying to display the list of users online. And I have a sql but in my page it says " You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 8 ", I was wondering how do I display the list of users with out any errors.

<?php $sql = "SELECT
        user_id,
        user_name,          
        online
    FROM
        users
    WHERE
        user_id = " . mysql_real_escape_string($_GET['id']);

$result = mysql_query($sql);

if(!$result)
{
echo 'There are currently no user online.' . mysql_error();
}
else
{
if(mysql_num_rows($result) == 0)
{
    echo 'There are currently no user online.';
}
else
{
    //display category data
    while($row = mysql_fetch_assoc($result))
    { $D= $row['online']; 
    if( ($D) !=1)
    {
    echo 'There are currently no user online.';
}
else
{ 
         echo'<a href="/index.php?area=profile&userid=' .   $posts_row['user_id'] . '" class="topicuser_member"><span ' . $posts_row['user_class'] .  '>' . $posts_row['user_name'] . '</span></a>,';}}}}?>

Answer 1

You need quotes around your string in the where clause:

$sql = "SELECT
    user_id,
    user_name,
    online
FROM
    users
WHERE
    user_id = '" . mysql_real_escape_string($_GET['id']) . "'";

Answer 2

Is the variable 'id' defined? also if you are trying to get a list of online users you have the sql query wrong, it should be

$sql = "SELECT
    user_id,
    user_name,          
    online
FROM
    users
WHERE
    //here you should have the online column       
    online = online" or whatever the online value you have set

Answer 3

A) Manual string escaping is a bad idea & leaves you open to SQL injection on the chance you forget to do it. Drop mysql_real_escape_string() and look into using PDO with bound variables so you never have to worry about it again.

B) You're trying to query the details of a single user ID. This is only ever going to tell you if a single user is online or not. Not very useful. You probably want to just drop your WHERE clause, if you're shooting for a list of all the online users.

C) A list of all online users can quickly grow out of control if you have any meaningful number of users. I'd strongly suggest falling back to a straight count of users (potentially with a page of all online users if anyone really wants that much information).