将_POST变量传递给Mysql WHERE子句

Question

<?php
//Connect to DB
$dbcnx = @mysql_connect("$db_host", $db_user, "$db_password");
if (!$dbcnx) {
 echo( "<P>Unable to connect to the " .
    "database server at this time.</P>" );
 exit();
}
mysql_select_db("daily_audit", $dbcnx);
// Request the text of all the hosts
if(!empty($_POST['checklist'])) {
    foreach($_POST['checklist'] as $check) {
        $result = mysql_query(
           "DELETE FROM hosts_list WHERE IP_Address = %s ", $check);
if (!$result) {
 echo("<P>Error performing query: " .
     mysql_error() . "</P>");
 exit();
}
    }
}
?>

我在运行以下代码时遇到问题.我已经确认_POST变量包含数据,但我很确定我的SQL查询是如何处理的.对不起,我是PHP n00b,我想了解如何纠正这个问题.我知道查询可能需要''围绕IP地址,这使得这个棘手.在此先感谢所有人.

Answer 1

该mysql_query函数无法格式化字符串.

你可能在考虑sprintf():

$query = sprintf("DELETE FROM hosts_list
                  WHERE IP_Address = %s", mysql_real_escape_string($check));
$result = mysql_query($query);

考虑切换到PDO或mysqli,因为现在不推荐使用mysql扩展.