2012-08-31 3 views
-7

나는 당신은 당신의 SQL 구문에 오류가SQL 구문 오류 urgnet

를보고이 전대있다; 올바른 구문을 찾으려면 MySQL 서버 버전에 해당하는 설명서를 확인하십시오. 1시에 '-5,5'근처에서 사용하십시오.

그리고 오류를 찾을 수 없습니다.

이 스크립트는 도움이 될 것입니다. 이 코드에서 명확하지 않지만

<? 
require_once("conn.php"); 
require_once("includes.php"); 
require_once("templates/HeaderTemplate.php"); 
require_once("pageList.php"); 
// ADVANCED SEARCH 
//require_once("advanced.php"); 
//require_once("templates/AdvancedSearchTemplate.php"); 
$showall = false; 
if ($_REQUEST['stateid']) { 
    $sql = "Select full_name From states where state_id = ".$_REQUEST['stateid']; 
    $myr = mysql_query($sql) or die(mysql_error()); 
    $isAny = mysql_num_rows($myr); 
    $state_name = mysql_fetch_array($myr); 
    $show = "<table width=\"550\"><tr><td>Showing Listings For <font color=\"FF0000\" >$state_name[full_name]</font></td></tr></table>"; 
}  
else { 
    $show = "Showing All Listings"; 
    $showall = true; 
} 

//print "The Value Of ... ".$isAny; 
//echo "<BR><b>&nbsp;&nbsp;&nbsp;".$show; 
if ($_REQUEST['stateid']) 
    $addsql = "and re_listings.state_id=".$_REQUEST['stateid']; 
else 
    $addsql =""; 
$q1 = "select * from re_listings, re_agents, re_priority where re_listings.AgentID = re_agents.AgentID and re_agents.PriorityLevel = re_priority.PriorityLevel and re_agents.AccountStatus = 'active' ".$addsql; 
$rsQ = mysql_query($q1); 
$total_records = mysql_num_rows($rsQ); 
if($total_records== 0) 
{ 
     $ListingTable = "<table align=center width=500 cellspacing=0>\n"; 
    $ListingTable .= "<tr>\n<td>$links</td></tr>\n\t"; 
    $ListingTable .= "<tr>\n<td>&nbsp;</td></tr>\n\t"; 
    $ListingTable .= "</tr>\n</table>\n\n"; 
    $ListingTable .= "<br><br><center><Strong>No Results Was Found!</Strong></center>"; 
require_once("templates/HeaderTemplate.php"); 
require_once("templates/SearchTemplate.php"); 
require_once("templates/FooterTemplate.php"); 
} 
$records_per_page = 5; // no of records per page 
$current_page_no = 1; 

    if ($_REQUEST['page']) 
    { 
     $current_page_no = $_REQUEST['page']; 
    } 
    $pageL = new pageList($total_records, $records_per_page, $current_page_no); 
    $pageL->generate(); 
//print $addsql."<BR>"; 
//print "startRecord: ".$pageL->startRecord; 
$q2 = "select * from re_listings, re_agents, re_priority where re_listings.AgentID = re_agents.AgentID and re_agents.PriorityLevel = re_priority.PriorityLevel and re_agents.AccountStatus = 'active' ".$addsql." order by visits desc LIMIT $pageL->startRecord,$pageL->numOfRows"; 
$r1 = mysql_query($q2) or die(mysql_error()); 
$lrows = mysql_num_rows($r1); 
if($lrows > '0') 
{ 
    $ListingTable .= "<table align=center width=500 cellspacing=0>\n"; 

    $ListingTable .= "<tr>\n<td width=75>&nbsp;</td>\n\t"; 

// $ListingTable .= "<td width=200 align=center><a class=BlackLink href=\"search.php?c=$_GET[c]&s=$_GET[s]&AgentID=$_GET[AgentID]&search_city=$_GET[search_city]&search_state=$_GET[search_state]&search_country=$_GET[search_country]&search_PropertyType=$_GET[search_PropertyType]&MinPrice=$_GET[MinPrice]&MaxPrice=$_GET[MaxPrice]&rooms1=$_GET[rooms1]&rooms2=$_GET[rooms2]&bath1=$_GET[bath1]&bath2=$_GET[bath2]&before=$_GET[before]&school=$_GET[school]&transit=$_GET[transit]&park=$_GET[park]&ocean_view=$_GET[ocean_view]&lake_view=$_GET[lake_view]&mountain_view=$_GET[mountain_view]&ocean_waterfront=$_GET[ocean_waterfront]&lake_waterfront=$_GET[lake_waterfront]&river_waterfront=$_GET[river_waterfront]&city=1&page=$_REQUEST[page]\">address</a></td>\n\t"; 

// $ListingTable .= "<td width=125 align=center><a class=BlackLink href=\"search.php?c=$_GET[c]&s=$_GET[s]&AgentID=$_GET[AgentID]&search_city=$_GET[search_city]&search_state=$_GET[search_state]&search_country=$_GET[search_country]&search_PropertyType=$_GET[search_PropertyType]&MinPrice=$_GET[MinPrice]&MaxPrice=$_GET[MaxPrice]&rooms1=$_GET[rooms1]&rooms2=$_GET[rooms2]&bath1=$_GET[bath1]&bath2=$_GET[bath2]&before=$_GET[before]&school=$_GET[school]&transit=$_GET[transit]&park=$_GET[park]&ocean_view=$_GET[ocean_view]&lake_view=$_GET[lake_view]&mountain_view=$_GET[mountain_view]&ocean_waterfront=$_GET[ocean_waterfront]&lake_waterfront=$_GET[lake_waterfront]&river_waterfront=$_GET[river_waterfront]&r=1&page=$_REQUEST[page]\">bed, bath, garage</a></td>\n\t"; 

// $ListingTable .= "<td align=center width=100><a class=BlackLink href=\"search.php?c=$_GET[c]&s=$_GET[s]&AgentID=$_GET[AgentID]&search_city=$_GET[search_city]&search_state=$_GET[search_state]&search_country=$_GET[search_country]&search_PropertyType=$_GET[search_PropertyType]&MinPrice=$_GET[MinPrice]&MaxPrice=$_GET[MaxPrice]&rooms1=$_GET[rooms1]&rooms2=$_GET[rooms2]&bath1=$_GET[bath1]&bath2=$_GET[bath2]&before=$_GET[before]&school=$_GET[school]&transit=$_GET[transit]&park=$_GET[park]&ocean_view=$_GET[ocean_view]&lake_view=$_GET[lake_view]&mountain_view=$_GET[mountain_view]&ocean_waterfront=$_GET[ocean_waterfront]&lake_waterfront=$_GET[lake_waterfront]&river_waterfront=$_GET[river_waterfront]&p=1&page=$_REQUEST[page]\">price</a></td>\n"; 

    $ListingTable .= "</tr>\n</table>\n\n"; 
    $ListingTable .= "<table align=center width=500 border=0 bordercolor=#336699 rules=rows cellspacing=0>\n"; 

$start = $pageL->startRecord+1; 
$end = $records_per_page*$current_page_no; 
$totalpages = $pageL->getTotalPage(); 
if ($current_page_no==$totalpages) 
$end = $pageL->getTotalRecords(); 
    $rec_info = "<strong>Showing Listings $start - $end</strong>"; 
    $ListingTable .= "<tr>\n<td colspan=4>$rec_info</td></tr>\n\t"; 

    while($a1 = mysql_fetch_array($r1)) 
    { 

     $ListingTable .= "<tr style=\"border-width:1; border-color:blue\" onMouseOver=\"this.style.background='#FFFFFF'; this.style.cursor='hand'\" onMouseOut=\"this.style.background='white'\" onClick=\"window.open('info.php?id=$a1[ListingID]', '_top')\">\n\t"; 

     $ListingTable .= "<td height=60>"; 
     $ListingTable .= "<table align=center width=\"100%\">\n"; 

     $ListingTable .= "<TR style=\"background-color:#001592; color:white; font-family:verdana; font-size:11; font-weight:bold; height=20px \">\n<TD colspan=4>\n$a1[PriorityName] listing</TD>\n</TR>\n"; 
//  $ListingTable .= "<caption align=left><span class=RedLink>$a1[PriorityName] listing</span></caption>\n"; 
     $ListingTable .= "<tr>\n\t<td width=75>"; 
//Price formatting 
     $MyPrice = number_format($a1[Price], 2, ".", "'"); 
//State Formatting 
    if(empty($a1[state_id])) 
     $state = "Not Available"; 
    else 
     { 
      $state_id = $a1[state_id]; 
      $sql = "Select full_name from states where state_id=$state_id"; 
      $myrs = mysql_query($sql) or die(mysql_error()); 
      $statename = mysql_fetch_array($myrs); 
      $state = $statename[full_name]; 

     } 

    $ListingTable =$ListingTable."<TR bgcolor=\"D2EEFF\"><TD width=\"20%\"><b>Country: </b></TD><TD width=\"20%\"> $a1[country]</TD>"; 
    $ListingTable =$ListingTable."<TD width=\"20%\"><b>State: </b></TD><TD width=\"20%\">$state</TD></TR>"; 
    $ListingTable =$ListingTable."<TR bgcolor=\"FFFFFF\">\n\t<td valign=top width=\"20%\"><B>City: </b></td><td valign=top width=\"20%\">$a1[city]</td>"; 
    $ListingTable =$ListingTable."<TD width=\"20%\"><b>Address: </b></TD><TD width=\"20%\"> $a1[address]</TD></TR>"; 
    $ListingTable =$ListingTable."<TR bgcolor=\"D2EEFF\"><TD width=\"20%\"><b>Price: </b></TD><TD width=\"20%\"> $$MyPrice</TD>"; 
    $ListingTable =$ListingTable."<TD width=\"20%\"><b>SqMeters: </b></TD><TD width=\"20%\"> $a1[SquareMeters] sq.m.</TD</TR>"; 
     $ListingTable .= "</td>\n\t"; 
     $ListingTable .= "</tr>\n"; 

     $ListingTable .= "<HR>"; 
     $ListingTable .= "</table>\n\n</td>\n</tr>\n\n"; 
    } 
    $ListingTable .= "</table>"; 

} 
else 
{ 
    $ListingTable = "<table align=center width=500 cellspacing=0>\n"; 
// $ListingTable .= "<tr>\n<td>$links</td></tr>\n\t"; 
    $ListingTable .= "<tr>\n<td>&nbsp;</td></tr>\n\t"; 
    $ListingTable .= "</tr>\n</table>\n\n"; 
    $show = "<table align=center width=550 cellspacing=0><tr><td><br><br><center><Strong>No Results Was Found!</Strong></center></td></tr></table>"; 

} 
echo "<BR><b>&nbsp;&nbsp;&nbsp;".$show; 
/* 
if ($_REQUEST['stateid'] == 0){ 
echo "<table border=0 align=center><tr><td align=center><object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0\" width=\"400\" height=\"275\"> 
    <param name=\"movie\" value=\"usmap.swf\"> 
    <param name=\"quality\" value=\"high\"> 
    <embed src=\"usmap.swf\" quality=\"high\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" type=\"application/x-shockwave-flash\" width=\"500\" height=\"325\"></embed>\" 
</object></td></tr></table>"; 
}*/ 

require_once("templates/SearchTemplate.php"); 
require_once("templates/FooterTemplate.php"); 
?> 
+4

첫 번째 경고 : "전체 이름 선택 상태에서 state_id =". $ _ 요청 [ 'stateid']; 절대 생산에 넣지 마십시오. 매우 불안합니다. SQL 인젝션에 대해 들었습니까? – SirDarius

+4

당신이 downvotes로 묻히기 대신에 반응하고 싶다면 "긴급", "중요"를 사용하지 마십시오. 그것은 당신 누구를 위해서도 급박하거나 중요하지 않습니다. –

+0

먼저해야 할 일 : mysql_error()를 작성하는 대신 mysql_error()를 작성하십시오. "Query : queryhere", 여기서 queryhere는 쿼리 변수입니다. – think123

답변

1

, 나는 오류를 casuing되는 쿼리이 하나라고 생각 :

$q2 = " 

select 
    * 
from 
    re_listings, 
    re_agents, 
    re_priority 
where 
    re_listings.AgentID = re_agents.AgentID 
    and re_agents.PriorityLevel = re_priority.PriorityLevel 
    and re_agents.AccountStatus = 'active' 
    ".$addsql." 
order by 
    visits desc 
LIMIT 
    $pageL->startRecord,$pageL->numOfRows 
"; 

당신은 아마 한계 절에 음의 값을 전달하는 당신을 할 수 없다.

$pageL->startRecord이 0보다 작은 지 확인하고 가능한 경우 0으로 변경하십시오.

2

이 하나를 시도,

$start_record = ($pageL->startRecord>=0) ? $pageL->startRecord : 0; 

    $q2 = " 

    select 
     * 
    from 
     re_listings, 
     re_agents, 
     re_priority 
    where 
     re_listings.AgentID = re_agents.AgentID 
     and re_agents.PriorityLevel = re_priority.PriorityLevel 
     and re_agents.AccountStatus = 'active' 
     ".$addsql." 
    order by 
     visits desc 
    LIMIT 
     $start_record,$pageL->numOfRows 
    "; 
0
$ListingTable = "<table align=center width=500 cellspacing=0>\n"; 

나는 당신이 넣어 잊어 생각한다 "." 이에.

$ListingTable .= "<table align=center width=500 cellspacing=0>\n"; 

드림위버 라인 번호. 123