GET参数未通过

Question

尝试传递GET变量时出现奇怪的错误。 在产品页面上，同一商品有多种尺寸，每种尺寸都有自己的形式，其中包含两个变量， product ID (product_id)和quantity (qty) ，这些变量发送到另一个页面（add.php），以添加到大车。

我的问题是qty传递没有问题，但是product_id没有通过，我使用Burp套件检查了服务器和客户端之间发送的数据，当我单击product_id按钮时， product_id没有附加到URL（因为我们可以在下面看到）

GET /newsite/add.php?qty=1 HTTP / 1.1

这是我使用的代码

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
    echo '<form action="add.php?product_id='.$selectRow['product_id'].'&qty=<script>document.getElementById(\'qty'.$i.'\').value</script>" class="form form-inline clearfix">
    <span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
    <span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
    <span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
    <span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
    <span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
    &nbsp;
    <div class="numbered">
        <input type="text" name="qty" id="qty'.$i.'" value="1" class="tiny-size" />
        <span class="clickable add-one icon-plus-sign-alt"></span>
        <span class="clickable remove-one icon-minus-sign-alt"></span>
    </div>';
    if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
        echo '<span class="stock">
            <span class="btn btn-warning" id="stock">Ask for availability</span>
            </span>';
    if($selectRow['product_oos'] == 1)
        echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
    else
        echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
    echo '</form>';
    $i++;
}

这是我们通过查看已加载页面的源代码可以看到的

<form action="add.php?product_id=559&amp;qty=&lt;script&gt;document.getElementById('qty0').value&lt;/script&gt;" class="form form-inline clearfix">

我不明白为什么将qty附加到URL而不是product_id后面。

Answer 1

在这种情况下，您必须在隐藏字段中传递变量。 不要让简单的事情变得复杂。

<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />

和做

<input type="text" name="qty"  id="qty'.$i.'" value="1" class="tiny-size" />

至

<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />

现在您的代码看起来像。

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY     length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
echo '<form action="add.php" class="form form-inline clearfix">
<span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
<span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
<span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
<span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
<span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
&nbsp;
<div class="numbered">
<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />       
<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />
    <span class="clickable add-one icon-plus-sign-alt"></span>
    <span class="clickable remove-one icon-minus-sign-alt"></span>
</div>';
if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
    echo '<span class="stock">
        <span class="btn btn-warning" id="stock">Ask for availability</span>
        </span>';
if($selectRow['product_oos'] == 1)
    echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
else
    echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
echo '</form>';
$i++;

}