在 wordpress 中提交表單時出現 SQL 錯誤

Question

我在數據庫中有一個表，其中包含 2 列，一列用於 PLZ（郵政編碼），另一列用於鏈接，我有一個包含輸入和按鈕的表單。 所需的工作是當我在表單中鍵入 PLZ 並單擊按鈕時，我們將提供與此 PLZ 對應的鏈接

<?php
 require('../../../wp-blog-header.php');
 require('../../../wp-config.php');

if(isset($_POST['submit']))
{
    // WP Globals
    global $table_prefix, $wpdb;

    // Customer Table
    $customerTable = $table_prefix . 'customer';
    $PLZ = $_POST['PLZ'];
    // search in all table columns
    $query = "SELECT Link 
    FROM $customerTable
    WHERE  PLZ = '$PLZ'
    ";
    $search_result = submit($query);
    
}
 else {
   echo 'error';
}
// function to connect and execute the query
function submit($query)
{
    global  $wpdb ;
    $search_result = $wpdb->get_results($query);
    foreach($search_result as $row){
        header('Location: '.$row['Link']);
    }

}
?>

這是表格

<?php
function oped_postcode_form_function() { 
   
       <form  method="get" action="<?php echo plugins_url('action.php', __FILE__ ); ?>">
   <label>Postleitzahl</label><input type="text" pattern="[0-9]{5}" title="Five digit zip code" />
   <button name="submit">submit</button>
   </form>
   <?php
       } 
       // register shortcode
       add_shortcode('oped_postcode_form', 'oped_postcode_form_function'); 

?>

結果總是出錯

Answer 1

您的表單向服務器發送 GET 請求，因此您需要在 PHP 代碼中使用$_GET數組：

<?php
 require('../../../wp-blog-header.php');
 require('../../../wp-config.php');

if(isset($_GET['submit']))
{
    // WP Globals
    global $table_prefix, $wpdb;

    // Customer Table
    $customerTable = $table_prefix . 'customer';
    $PLZ = $_GET['PLZ'];
    // search in all table columns
    $query = $wpdb->prepare("SELECT Link FROM $customerTable WHERE  PLZ = %s", $PLZ);
    $search_result = submit($query);
    
}
else {
   echo 'error';
}
// function to connect and execute the query
function submit($query)
{
    global  $wpdb ;
    $search_result = $wpdb->get_results($query);
    foreach($search_result as $row){
        header('Location: '.$row['Link']);
    }

}
?>

您還應該使用准備好的語句來防止 SQL 注入