ALL을 선택할 때 ALL 레코드를 표시하는 방법

Question

select onchange 이벤트에서 ALL을 선택하면 while 루프가 실행되지 않습니다.

dropdown.php 

     <script> 
     function showUser(str) 
     { 
     if (str=="") 
      { 
      document.getElementById("txtHint").innerHTML=""; 
      return; 
      } 
     if (window.XMLHttpRequest) 
      {// code for IE7+, Firefox, Chrome, Opera, Safari 
      xmlhttp=new XMLHttpRequest(); 
      } 
     else 
      {// code for IE6, IE5 
      xmlhttp=new ActiveXObject("Microsoft.XMLHTTP"); 
      } 
     xmlhttp.onreadystatechange=function() 
      { 
      if (xmlhttp.readyState==4 && xmlhttp.status==200) 
      { 
      document.getElementById("txtHint").innerHTML=xmlhttp.responseText; 
      } 
      } 
     xmlhttp.open("GET","getuser.php?q="+str,true); 
     xmlhttp.send(); 
     } 
     </script> 

    <?php 
    $mysqli = new mysqli("localhost", "root", "", "app"); 
    $result = $mysqli->query("SELECT rfq FROM procurement GROUP BY rfq ORDER BY rfq"); 

    $option = ''; 
    while($row = $result->fetch_assoc()) 
    { 
     $option .= '<option value = "'.$row['rfq'].'">'.$row['rfq'].'</option>'; 
    } 
    ?> 

    <select name="users" onchange="showUser(this.value)"> 
      <option value="ALL" selected='ALL'>ALL</option> 
      <?php echo $option; ?> 
    </select> 

    <br> 
    <div id="txtHint"></div> 

내가 showuser에 몸을 설정

<?php 
    $mysqli = new mysqli("localhost", "root", "", "app"); 
    $q=$_GET["q"]; 

    $result1 = $mysqli->query("SELECT *,SUM(unit_cost*quantity) AS total_amount FROM procurement WHERE rfq='".$q."' GROUP BY counter ORDER BY rfq"); 

    echo'<table id="tfhover" cellspacing="0" class="tablesorter"> 
      <thead> 
      <tr> 
       <th id="none" class="none" title="RFQ"></th> 
       <th title="RFQ">RFQ #</th> 
       <th title="Item Name">Item Name</th> 
       <th title="Item Description">Description</th> 
       <th title="Example : Pc, Pcs, Box and Etc.">Unit</th> 
       <th title="Item Price">Unit Cost</th> 
       <th title="Total Item Quantity">QTY</th> 
       <th title="Total Price">Total Amount</th> 
      </tr> 
      </thead>'; 
      echo'<tbody>'; 
    while($row = $result1->fetch_assoc()){ 
    echo'<tr> 
       <td align="center"><a href="comments.php?pn='.$row["rfq"].'"><img src="images/remarks.png" border="0" width="10" height="10" title="Remarks and Notes"></a></td> 
       <td>'.$row['rfq'].'</td> 
       <td>'.$row['item_name'].'</td> 
       <td>'.$row['item_description'].'</td> 
       <td>'.$row['unit'].'</td> 
       <td>'.number_format($row['unit_cost'], 2, '.', ',').'</td> 
       <td>'.$row['quantity'].'</td> 
       <td>'.number_format($row['total_amount'], 2, '.', ',').'</td> 
      </tr>'; 
      } 
     echo "</tbody></table>"; 


    echo $q; 
    if (!$mysqli) { 
     die('Connect Error: ' . mysqli_connect_error()); 
    } 
    mysqli_close($mysqli); 
     ?> 

getuser.php (STR = "ALL")하지만, 그냥 모든 동안 루프 ISN을 선택하면 사진처럼 실행 중입니다. 문제가 무엇입니까?

Answer 1

getuser.php는 조건부로 where 절을 제공하여 "ALL"의 의미를 반영해야합니다.

$q = $_GET["q"]; 
$where = ''; 
if ($q != 'ALL') { 
    $where = " WHERE rfq='$q' "; 
} 
$result1 = $mysqli->query(" 
    SELECT *,SUM(unit_cost*quantity) AS total_amount 
    FROM procurement 
    $where 
    GROUP BY counter ORDER BY rfq 
"); 

따라서 직접 SQL Injection을 초래할 수있는 SQL 쿼리를 사용하여, $_GET["q"]의 값이 살균되지 않도록 유의하시기 바랍니다.