GET參數未通過

Question

嘗試傳遞GET變量時出現奇怪的錯誤。 在產品頁面上，同一商品有多種尺寸，每種尺寸都有自己的形式，其中包含兩個變量， product ID (product_id)和quantity (qty) ，這些變量發送到另一個頁面（add.php），以添加到大車。

我的問題是qty傳遞沒有問題，但是product_id沒有通過，我使用Burp套件檢查了服務器和客戶端之間發送的數據，當我單擊product_id按鈕時， product_id沒有附加到URL（因為我們可以在下面看到）

GET /newsite/add.php?qty=1 HTTP / 1.1

這是我使用的代碼

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
    echo '<form action="add.php?product_id='.$selectRow['product_id'].'&qty=<script>document.getElementById(\'qty'.$i.'\').value</script>" class="form form-inline clearfix">
    <span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
    <span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
    <span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
    <span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
    <span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
    &nbsp;
    <div class="numbered">
        <input type="text" name="qty" id="qty'.$i.'" value="1" class="tiny-size" />
        <span class="clickable add-one icon-plus-sign-alt"></span>
        <span class="clickable remove-one icon-minus-sign-alt"></span>
    </div>';
    if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
        echo '<span class="stock">
            <span class="btn btn-warning" id="stock">Ask for availability</span>
            </span>';
    if($selectRow['product_oos'] == 1)
        echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
    else
        echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
    echo '</form>';
    $i++;
}

這是我們通過查看已加載頁面的源代碼可以看到的

<form action="add.php?product_id=559&amp;qty=&lt;script&gt;document.getElementById('qty0').value&lt;/script&gt;" class="form form-inline clearfix">

我不明白為什么將qty附加到URL而不是product_id后面。

Answer 1

在這種情況下，您必須在隱藏字段中傳遞變量。 不要讓簡單的事情變得復雜。

<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />

和做

<input type="text" name="qty"  id="qty'.$i.'" value="1" class="tiny-size" />

至

<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />

現在您的代碼看起來像。

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY     length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
echo '<form action="add.php" class="form form-inline clearfix">
<span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
<span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
<span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
<span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
<span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
&nbsp;
<div class="numbered">
<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />       
<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />
    <span class="clickable add-one icon-plus-sign-alt"></span>
    <span class="clickable remove-one icon-minus-sign-alt"></span>
</div>';
if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
    echo '<span class="stock">
        <span class="btn btn-warning" id="stock">Ask for availability</span>
        </span>';
if($selectRow['product_oos'] == 1)
    echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
else
    echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
echo '</form>';
$i++;

}