2 回答
TA贡献1828条经验 获得超3个赞
首先,我们不需要看到您的 submitArea 功能..
我确实修改、简化和保护了一点(不是全部,但仍然......)你的代码,请注意我没有测试它..
1) 在您的 HTML 中,删除您的.editBtn提交按钮。对于是/否选择,我建议您使用一些<select>下拉菜单或<input type="radio">按钮。
<form>
<table id="filter">
<div id="title"> <h4> Filters </h4></div>
<tr>
<th> <h4> Rooftop </h4> </th>
<th> <h4> Area </h4> </th>
<th> <h4> Happy Hour </h4> </th>
<th> <h4> Food </h4> </th>
</tr>
<tr>
<td>
<select id="rooftop" class="selectMenu">
<option value="">Select an option</option>
<option value="Yes">Yes</option>
<option value="No">No</option>
</select>
</td>
<td>
<div id="sortBy">
<button onclick="dropDown()" type="button" class="dropbtn"> ‿ </button>
<div id="myDropdown" class="dropdown-content">
<div id="area">
<input type="checkbox" class="get_value" id="loop" name="loop" value="Loop">Loop<br>
<input type="checkbox" class="get_value" id="Old Town" name="oldTown" value="Old Town"> Old Town <br>
<input type="checkbox" class="get_value" id="River North" name="riverNorth" value="River North"> River North <br>
<input type="checkbox" class="get_value" id="River West" name="riverWest" value="River West"> River West <br>
<input type="checkbox" class="get_value" id="West Loop" name="westLoop" value="West Loop"> West Loop <br>
<input id="areaSubmit" type="submit" value="Search" onclick("submitArea()")>
</div>
</div>
</td>
<td align="center">
<select id="happyHour" class="selectMenu">
<option value="">Select an option</option>
<option value="Yes">Yes</option>
<option value="No">No</option>
</select>
</td>
<td>
<select id="food" class="selectMenu">
<option value="">Select an option</option>
<option value="Yes">Yes</option>
<option value="No">No</option>
</select>
</td>
</tr>
</table>
</form>
2) 以数组的形式而不是一个接一个地发送您的区域,这使得循环和构建查询更容易,这里是使用 jQuery 对 submitArea() 函数进行的简单改造。
<script>
function submitArea() {
var post_vals = {
params: {
areas: [],
rooftop: 0,
happyHour: 0,
food: 0
}
};
$(".get_value checkbox:checked").each(function() {
post_vals.params.areas.push($(this).val());
});
$(".selectMenu option:selected").each(function() {
if($(this).attr("id") == "rooftop") {
post_vals.params.rooftop = 1;
} else if($(this).attr("id") == "happyHour") {
post_vals.params.happyHour = 1;
} else if($(this).attr("id") == "food") {
post_vals.params.food = 1;
}
});
alert("Check your console for posted value!");
console.log("Post values:");
console.log(post_vals);
$.getJSON("your_php_script.php", {
params: params
}).done(function(data) {
// For now if you look in the console, you'll only see your query..
alert("Post finished, check the response in your console.");
console.log(data);
// Get your data here and do what ever you want with it, IE: rebuild your table rows if they're not already existing.
});
}
</script>
3) 简化您的 PHP 并通过 SQL 注入更加安全,请在 google 或本网站上阅读有关此内容的信息。例如,我称它为 your_php_script.php ;)
<?php
require_once("database_connection.php");
$connection = db_connect();
$response = array(
"status" => "success",
"data" => array(), // Table data goes in here
"query" => "" // Temporairy, just for your example to show in your Javascript console
);
if(isset($_GET["params"]) && is_array($_GET["params"])) {
// Prepare mysql statement
$sql = "SELECT bar_name, area, hourStart, hourEnd FROM barInfo WHERE visible = 1";
// Loop over the sent parameters
foreach($_GET["params"] AS $key => $opt) {
if($key == "areas") {
if(is_array($opt)) {
// HERE Beware that you should check the values before you put them in the query for injections security reasons.
foreach($opt AS $k => $area) {
// Real basic method of doing it.. be aware that this is not bullet proof.
$opt[$k] = mysqli_real_escape_string($connection, $area);
}
$sql .= " AND area IN ('" . implode("', '", $opt) . "') ";
}
} else if($key == "rooftop") {
if($opt == 1) {
$sql .= " AND rooftop = 1 ";
} else {
$sql .= " AND rooftop = 0 ";
}
} else if($key == "happyHour") {
if($opt == 1) {
$sql .= " AND happyHour = 1 ";
} else {
$sql .= " AND happyHour = 0 ";
}
} else if($key == "food") {
if($opt == 1) {
$sql .= " AND food = 1 ";
} else {
$sql .= " AND food = 0 ";
}
}
}
$result = mysqli_query($connection, $sql);
if($result) {
while($row = mysqli_fetch_assoc($result)) {
$response["data"][] = $row;
}
// Temporairy
$response["query"] = $sql;
} else {
$response["status"] = "error";
$response["details"] = "MySQL Query error: " . mysqli_error($connection);
}
} else {
$response["status"] = "error";
$response["details"] = "Parameter received is not an array.";
}
echo json_encode($response);
我希望这会有所帮助。
- 2 回答
- 0 关注
- 171 浏览
添加回答
举报