PHP表格處理POST

Question

我正在嘗試使用表單處理來進行特定的數據庫查詢。 我將表單設置為$ name，並嘗試處理$ sql =“ SELECT * FROM quotes QSymbol = $ name ORDER BY qQuoteDateTime DESC”是執行此操作的最佳方法是什么？

<form action="post.php" method="post">
<span></span><input type = "text" value=" " name="boxy" />
<br/><input type="submit" name="submit" value="Enter" />
</form>

<?php
    $name = $_POST['boxy'];
    if(isset($_POST['boxy'])){
        error_reporting(E_ALL ^ E_DEPRECATED);

        $con = mysql_connect('...');
        if (!$con){
            die("Cannot connect : " . mysql_error());
        }
        mysql_select_db('quotesdb',$con);
        $sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC";
        $myData = mysql_query($sql,$con);
        echo "<table border = 1>
        <tr>
        <th>Data</th>
        <th>Last</th>
        <th>Change</th>
        <th>% Chg</th>
        <th>Volume</th>
        </tr>";

        while ($record = mysql_fetch_array($myData)){
            echo "<tr>";
            echo "<td>" . $record['qQuoteDateTime'] . "</td>";
            echo "<td>" . $record['qLastSalePrice'] . "</td>";
            echo "<td>" . $record['qNetChangePrice'] . "</td>";
            echo "<td>" . $record['qNetChangePct'] . "</td>";
            echo "<td>" . $record['qShareVolumeQty'] . "</td>";
            echo "</tr>";

        echo "</table>";



        mysql_close($con);




        }

Answer 1

除非變量是數字，否則仍然需要在變量周圍加上單引號

$sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC";