PHP MYSQL待办事项且仅当PHP会话变量存在

Question

我想我的MySQL查询取决于PHP变量（会话）的内容 是不同的它必须是这样的：

if ($_SESSION['session_id'] != NULL) { 
    $var1 = "and id = '$_SESSION[session_id]'"; 
} 
$result = mysql_query(" 
SELECT field1, field2 
FROM table 
WHERE name = '$_GET[name]' $var1 
") or die(mysql_error()); 

这将是：WHERE name = '$_GET[name]' and id = '$_SESSION[session_id]' 或：WHERE name = '$_GET[name]'

我该怎么做？谢谢。

Answer 1

您尝试创建的代码存在一些严重（并且不太严重）的问题，如果您想要使您的网站有用，则需要立即修复这些问题。

首先，不使用mysql_功能，但切换到mysqli或pdo。 mysql函数已被弃用。

此外，您将用户输入直接插入到您的查询中。这会导致一些严重的SQL注入问题。始终确保验证并逃避用户输入。

<?php 
$name = $_GET['name']; 

//validate $name according to your choice of mysql provider. EG: mysqli_real_escape_string 
//this is just basic validation. make sure you also add other types of validation. If a name is always alphanumeric, make sure you also check that it is before using it. 

/* 
if you dont validate and I would enter my name like: hugo' OR 1=1 -- 
I would be able to access any record in your database. And that is just a harmless example. 
*/ 

$query = "SELECT field1, field2 FROM table WHERE name = '".$name."'" 

//for sake of simplicity I assume the id is numeric 
if (!empty($_SESSION['session_id']) AND is_numeric($_SESSION['session_id'])) { 
    $query .= " and id = '".$_SESSION['session_id']."'"; 
} 

//exec query 
?>