Php 变量的lue.erm..我想我现在有点感觉了..有希望的erm..为什么有时他们会放'$变量。”或类似于$variableOutput.='blah blah blah'为什么“…”以及为什么`.=`?假设$variable='and'所以这个$变量。”“

Php 变量的lue.erm..我想我现在有点感觉了..有希望的erm..为什么有时他们会放'$变量。”或类似于$variableOutput.='blah blah blah'为什么“…”以及为什么`.=`?假设$variable='and'所以这个$变量。”“,php,mysql,prepared-statement,sql-injection,Php,Mysql,Prepared Statement,Sql Injection,变量的lue.erm..我想我现在有点感觉了..有希望的erm..为什么有时他们会放'$变量。”或类似于$variableOutput.='blah blah blah'为什么“…”以及为什么`.=`?假设$variable='and'所以这个$变量。”“将是这个和也将是”这个“将具有相同值的$variable。但是“this$variable that”将具有值this$variable that(注意变量未被替换) $sqlCommand = "(SELECT * FROM products


变量的lue.erm..我想我现在有点感觉了..有希望的erm..为什么有时他们会放
'$变量。”
或类似于
$variableOutput.='blah blah blah'为什么
“…”以及为什么`.=`?假设
$variable='and'所以
这个$变量。”“
将是
这个和
也将是
”这个“
将具有相同值的$variable。但是
“this$variable that”
将具有值
this$variable that
(注意变量未被替换)
$sqlCommand = "(SELECT * FROM products WHERE product_name LIKE '%$searchquery%' OR details LIKE '%$searchquery%' OR category LIKE '%searchquery%' OR subcategory LIKE '%searchquery%' OR price LIKE '%searchquery%') ";
} 
require_once("storescripts/connect_to_mysqli.php");
$query = mysqli_query($myConnection,$sqlCommand) or die(mysqli_error($myConnection));
$count = mysqli_num_rows($query);
if($count >= 1){
    $search_output .= "<hr />$count results for <strong>$searchquery</strong><hr />";
    while($row = mysqli_fetch_array($query)){
require_once ("storescripts/connect_to_mysqli.php");
$stmt = $myConnection->prepare('SELECT id, product_name, price FROM products WHERE product_name LIKE ? OR details LIKE ? OR category LIKE ? OR subcategory LIKE ? OR price LIKE ?');
$param = "%$searchquery%";
$stmt->bind_param('sssss', $param, $param, $param, $param, $param);
$stmt->execute();
/* store result */
$stmt->store_result();
/* get the row count */
$count = $stmt->num_rows;
if ($count >= 1) {
    $search_output = "<hr />$count results for <strong>$searchquery</strong><hr />";
    $stmt->bind_result($id, $product_name, $price);

    while ($stmt->fetch()) {
        printf("%s %s %s\n", $id, $product_name, $price);
->prepare('SELECT * FROM products WHERE product_name LIKE ? OR details LIKE ? OR category` LIKE ? OR subcategory LIKE ? OR price LIKE ?');
$stmt->bind_param('sssss', "%$searchquery%", "%$searchquery%", "%$searchquery%", "%$searchquery%", "%$searchquery%");
<?php

$search_output = "";

if (isset($_POST['searchquery']) && $_POST['searchquery'] != "") {
    $searchquery = preg_replace('/[^a-zA-Z0-9_ %\[\]\/\.\(\)%&-]/s', '', $_POST['searchquery']);
    if ($_POST['filter1'] == "Products") {
        require_once ("storescripts/connect_to_mysqli.php");
        //syntax error string not quoted properly
        $stmt = $myConnection->prepare('SELECT * FROM products WHERE product_name LIKE ? OR details LIKE ? OR category LIKE ? OR subcategory LIKE ? OR price LIKE ?');
        $param = "%$searchquery%";
        $stmt->bind_param('sssss', $param , $param , $param , $param , $param);
        $stmt->execute();
        $stmt->bind_result($id, $product_name, $price);

        while ($stmt->fetch()) {
            printf("%s %s %s\n", $id, $product_name, $price);
            $search_output .= "
            <li><div class='product'>
            <a href='product.php?id=$id' class='info'>
            <span class='holder'>
            <img src='inventory_images/$id.jpg' alt='$product_name' />
            <span class='book-name'>$product_name</span>
            </a>
             <a href='product.php?id=$id' class='buy-btn'>RM<span class='price'>$price</span></a>
            </div>
            </li>

            ";
        }//While loop was not closed

    } else {
        $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />";
    }
}
?>
<?php

$search_output = "";

if (isset($_POST['searchquery']) && $_POST['searchquery'] != "") {
    $searchquery = preg_replace('/[^a-zA-Z0-9_ %\[\]\/\.\(\)%&-]/s', '', $_POST['searchquery']);
    if ($_POST['filter1'] == "Products") {
        require_once ("storescripts/connect_to_mysqli.php");
        //syntax error string not quoted properly
        $stmt = $myConnection->prepare('SELECT * FROM products WHERE product_name LIKE ? OR details LIKE ? OR category LIKE ? OR subcategory LIKE ? OR price LIKE ?');
        $param = "%$searchquery%";
        $stmt->bind_param('sssss', $param , $param , $param , $param , $param);
        $stmt->execute();
        $stmt->bind_result($product_name, $price);

        while ($stmt->fetch()) {
            printf("%s %s\n", $product_name, $price, $totalpoints);

            $search_output .= "
            <li><div class='product'>
            <a href='product.php?id=$id' class='info'>
            <span class='holder'>
            <img src='inventory_images/$id.jpg' alt='$product_name' />
            <span class='book-name'>$product_name</span>
            </a>
             <a href='product.php?id=$id' class='buy-btn'>RM<span class='price'>$price</span></a>
            </div>
            </li>

            ";
        }//While loop was not closed

    } else {
        $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />";
    }
}
?>
$stmt->bind_param('s', '%$searchquery%');
$stmt->bind_result($product_name, $price);
$stmt->bind_result($product_name, $price, $totalpoints);
printf("%s %s\n", $product_name, $price, $totalpoints);
printf("%s %s %s\n", $product_name, $price, $totalpoints);
echo "$product_name $price $totalpoints\n";
$count = $stmt->num_rows;
$search_output = "";

if (isset($_POST['searchquery']) && $_POST['searchquery'] != "") {
    $searchquery = preg_replace('/[^a-zA-Z0-9_ %\[\]\/\.\(\)%&-]/s', '', $_POST['searchquery']);
    if ($_POST['filter1'] == "Products") {
        require_once ("storescripts/connect_to_mysqli.php");
        $stmt = $myConnection->prepare('SELECT id, product_name, price FROM products WHERE product_name LIKE ? OR details LIKE ? OR category LIKE ? OR subcategory LIKE ? OR price LIKE ?');
        $param = "%$searchquery%";
        $stmt->bind_param('sssss', $param, $param, $param, $param, $param);
        $stmt->execute();
        /* store result */
        $stmt->store_result();
        /* get the row count */
        $count = $stmt->num_rows;
        if ($count >= 1) {
            $search_output = "<hr />$count results for <strong>$searchquery</strong><hr />";
            $stmt->bind_result($id, $product_name, $price);

            while ($stmt->fetch()) {
                printf("%s %s %s\n", $id, $product_name, $price);
                $search_output .= "
                <li><div class='product'>
                <a href='product.php?id=$id' class='info'>
                <span class='holder'>
                <img src='inventory_images/$id.jpg' alt='$product_name' />
                <span class='book-name'>$product_name</span>
                </a>
                 <a href='product.php?id=$id' class='buy-btn'>RM<span class='price'>$price</span></a>
                </div>
                </li>

                ";
            }
        } else {
            $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />";
        }

    } else {
        $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />";
    }
}