2011-07-27 4 views
-3
function showSearchResults() 
{ 

$keyword = $_POST['keyword']; 

    $q = "SELECT * FROM user_info INNER JOIN project ON user_info.user_id = project.user_id 
    LEFT JOIN bedsize ON project.bedsize_fk = bedsize.bedsize_id 
    LEFT JOIN topics_of_improv ON project.p_id = topics_of_improv.p_id 
    LEFT JOIN medication ON topics_of_improv.medication_fk = medication.med_id 
    LEFT JOIN care_trans ON topics_of_improv.care_trans_fk = care_trans.care_trans_id 
    LEFT JOIN hosp_acquired_infect ON topics_of_improv.hosp_acquired_infect_fk = hosp_acquired_infect.hai_id 
    LEFT JOIN hosp_patient_care_pro ON topics_of_improv.hosp_patient_care_pro_fk = hosp_patient_care_pro.hpcp_id 
    LEFT JOIN health_it ON topics_of_improv.health_it_fk = health_it.health_it_id 
    LEFT JOIN teamwork ON topics_of_improv.teamwork_fk = teamwork.teamwork_id 
    LEFT JOIN project_diss ON topics_of_improv.project_diss_fk = project_diss.project_diss_id 
    LEFT JOIN resources ON topics_of_improv.resources_fk = resources.resources_id LEFT JOIN summary ON project.p_id = summary.p_id 
    LEFT JOIN process ON summary.process_fk = process.process_id 
    WHERE (project.description LIKE '%" . $keyword . "%' 
    OR summary.improvement LIKE '%" . $keyword . "%' 
    OR summary.interventions LIKE '%" . $keyword . "%' 
    OR summary.brief LIKE '%" . $keyword . "%' 
    OR summary.lessons LIKE '%" . $keyword . "%' 
    OR summary.actions LIKE '%" . $keyword . "%' 
    OR summary.measures LIKE '%" . $keyword . "%' 
    OR summary.clinical LIKE '%" . $keyword . "%') 
    ORDER BY project.p_id DESC"; 

    @$type = $_POST['type']; 
    @$state = $_POST['state']; 
    @$bedsize = $_POST['bedsize']; 
    @$care_trans = $_POST['care_trans']; 
    @$health_it = $_POST['health_it']; 
    @$hai = $_POST['hai']; 
    @$hpcp = $_POST['hpcp']; 
    @$medication = $_POST['medication']; 
    @$process = $_POST['process']; 
    @$project_diss = $_POST['pro_diss']; 
    @$resources = $_POST['resources']; 
    @$teamwork = $_POST['teamwork']; 

    $uid = $_SESSION['userid']; 

     if ($_SESSION['level'] == '0') 
     //$q .= "AND project.approved = 'yes' "; 

     //if($uid) 
     //$q .= "AND project.user_id = '".$uid."' "; 

     if($uid) 
     $q .= "AND project.user_id = '".$uid."' OR project.approved = 'yes'"; 

     if($type) 
     $q .= " AND project.type = '".$type."' "; 

     if($state) 
     $q .= " AND project.p_state = '".$state."' "; 

     if($bedsize) 
     $q .= " AND bedsize.bedsize_id = '".$bedsize."' "; 

     if($care_trans) 
     $q .= " AND care_trans.care_trans_id = '".$care_trans."' "; 

     if($health_it) 
     $q .= " AND health_it.health_it_id = '".$health_it."' "; 

     if($hai) 
     $q .= " AND hosp_acquired_infect.hai_id = '".$hai."' "; 

     if($hpcp) 
     $q .= " AND hosp_patient_care_pro.hpcp_id = '".$hpcp."' "; 

     if($medication) 
     $q .= " AND medication.med_id = '".$medication."' "; 

     if($process) 
     $q .= " AND project.p_state = '".$process."' "; 

     if($project_diss) 
     $q .= " AND project_diss.project_diss_id = '".$project_diss."' "; 

     if($resources) 
     $q .= " AND resources.resources_id = '".$resources."' "; 

     if($teamwork) 
     $q .= " AND teamwork.teamwork_id = '".$teamwork."' "; 


     $result = mysql_query($q) or die(mysql_error()); 

     if(mysql_num_rows($result)==0){ 
      echo "<tr>"; 
      echo "<td>No records matched your search criteria</td>"; 
      echo "<td></td>"; 
      echo "<td><a href='advanced_search.php'>Please click here to try again</a></td>"; 
      echo "<td></td>"; 
      echo "<td></td>"; 
      echo "<td></td>"; 
      echo "</tr>"; 
     } 

      while($row = mysql_fetch_array($result)){ 

       $p_id = $row["p_id"]; 
       $uid = $row["user_id"]; 
       $firstname = $row["firstname"]; 
       $lastname = $row["lastname"]; 
       $title = $row["title"]; 
       $description = $row["description"]; 
       $p_hospital = $row["p_hospital"]; 
       $approved = $row["approved"]; 

       if($_GET['order'] == "submitter"){ 
        echo "<tr>"; 
        echo "<td>$firstname $lastname</td>"; 
        echo "<td>$p_hospital</td>"; 
        echo "<td>$description</td>"; 
        echo "<td>"; 
        echo ($approved == "Yes") ? "<img src='imgs/check.png' />" : "<img src='imgs/pending.png' />" ; 
        echo "</td>"; 
        echo "<td>$title</td>"; 
        echo "<td><a href='details.php?p_id=$p_id'>View</a><br /></td>"; 
        echo "</tr>"; 
       }else if($_GET['order'] == "hospital"){ 
        echo "<tr>"; 
        echo "<td>$p_hospital</td>"; 
        echo "<td>$description</td>"; 
        echo "<td>"; 
        echo ($approved == "Yes") ? "<img src='imgs/check.png' />" : "<img src='imgs/pending.png' />" ; 
        echo "</td>"; 
        echo "<td>$title</td>"; 
        echo "<td>$firstname $lastname</td>"; 
        echo "<td><a href='details.php?p_id=$p_id'>View</a><br /></td>"; 
        echo "</tr>"; 
       }else if($_GET['order'] == "keywords"){ 
        echo "<tr>"; 
        echo "<td>$description</td>"; 
        echo "<td>"; 
        echo ($approved == "Yes") ? "<img src='imgs/check.png' />" : "<img src='imgs/pending.png' />" ; 
        echo "</td>"; 
        echo "<td>$title</td>"; 
        echo "<td>$firstname $lastname</td>"; 
        echo "<td>$p_hospital</td>"; 
        echo "<td><a href='details.php?p_id=$p_id'>View</a><br /></td>"; 
        echo "</tr>"; 
       }else if($_GET['order'] == "status"){ 
        echo "<tr>"; 
        echo "<td>"; 
        echo ($approved == "Yes") ? "<img src='imgs/check.png' />" : "<img src='imgs/pending.png' />" ; 
        echo "</td>"; 
        echo "<td>$title</td>"; 
        echo "<td>$firstname $lastname</td>"; 
        echo "<td>$p_hospital</td>"; 
        echo "<td>$description</td>"; 
        echo "<td><a href='details.php?p_id=$p_id'>View</a><br /></td>"; 
        echo "</tr>"; 
       }else{ 
        echo "<tr>"; 
        echo "<td>$title</td>"; 
        echo "<td>$firstname $lastname</td>"; 
        echo "<td>$p_hospital</td>"; 
        echo "<td>$description</td>"; 
        echo "<td>"; 
        echo ($approved == "Yes") ? "<img src='imgs/check.png' />" : "<img src='imgs/pending.png' />" ; 
        echo "</td>"; 
        echo "<td><a href='details.php?p_id=$p_id'>View</a><br /></td>"; 
        echo "</tr>"; 
       } 
      } 

    } 
} 
+2

일부 작업은 직접 처리해야합니다. 관련성이없는 쿼리의 부분을 제거하십시오. 내 기능 **이 깨 졌음을 의미하는 ** 결과 - 예기치 않은 결과, 오류 메시지를 알려주십시오. (힌트 : 당신을 도우려는 다른 사람들에게 에러 메시지가 유용 할 수 있습니다.) –

답변

0

ORDER BY 키워드는 결과 집합을 정렬하는 데 사용됩니다. project.p_id DESC은 결과 집합의 일부가 아닙니다. 그것은 당신의 코드는 일이 기다리고 SQL injection attack처럼 보이는 모든

SELECT user_info.column_name,....,project.p_id FROM user_info ........ 
+0

'ORDER BY'는 필드가'SELECT'인지 여부에 상관없이 작동합니다. –

+0

Ilmari Karonen의 계단에서만 작동했지만 어쨌든 고맙습니다. – Kris

4

먼저해야합니다. 이와 같이 손으로 SQL 쿼리를 작성해야하는 경우 적어도 입력 변수에 mysql_real_escape_string()을 사용하십시오. 당신이 알아서하면

은의 ORDER BY 그 방법을 쿼리의 처음 부분 밖으로 ORDER BY project.p_id DESC을, 그냥 라인

$result = mysql_query($q) or die(mysql_error()); 

전에

$q .= " ORDER BY project.p_id DESC "; 

를 추가 절은 쿼리가 끝나는 곳에 있습니다.

+3

힌트 SQL 주입 취약점. – phlogratos

+0

이 답변은 완벽했고 이제는 내 페이지가 작동합니다. 대단히 감사합니다! – Kris

1

코드는 변수 y의 쿼리에 WHERE 절을 추가로 추가합니다. 이것은 q가 WHERE 절로 끝나는 경우에 작동하지만, q가 ORDER BY으로 끝나면 작동하지 않습니다. 당신이해야 할 일은 ORDER BY이 결국 WHERE 절이되도록하는 것입니다.

관련 문제