POST https://www....?action=getclientRecords

Question

我有 2 个动态依赖 SelectBoxes，一个带有客户名称，另一个带有发票日期，带有一个按钮，可分别根据客户名称和他的日期获取数据，并填充下面的表单字段。整个过程已完成并且正在运行，但由于日期未获取，整个过程停止。现在客户由我决定，我不知道该怎么办。我不太擅长 php 或 js。如果你们能帮我解决这个问题，并试着用更简单的方式解释我会欠你们的。TIA。

它工作正常，但突然它获取客户名称而不是日期，我不知道为什么。该程序运行正常近 5 6 个月，但几天前此错误突然发生，没有任何更改。

我试图创建新的数据库思考可能是错误但它没有用。

我还使用备份恢复了代码文件，但仍然没有运气。

//数据.php

<?php

    require '../db_connection.php';

    header("Access-Control-Allow-Origin: *");

    $action = $_GET['action'];

    if($action=="getclientRecords"){

        getclientRecords($con);

    }

    function getclientRecords($con){

      $id = $_POST['client_id'];

       $sql="SELECT `invoice_data`.`item_date` FROM `invoice_data` WHERE `invoice_data`.`client_id`=$id";

       $result = mysqli_query($con, $sql);

       $results = mysqli_fetch_all($result);

       return json_encode($results);

    }

    $date = $_GET['action'];

    if($date=="getclientRecordByDate"){

    getclientRecordByDate($con);

    }

    function getclientRecordByDate($con){

         $client_date = $_POST["date"];

         $client_id = $_POST["client_id"];

         $sql = "SELECT client_name, `item_date`, item_refe, item_parti, balance_amount, item_amnd, item_amnf, item_tax, item_amniw, item_amnif FROM `invoice_data` WHERE `item_date` = '$client_date' AND client_id = '$client_id'";

         $result = mysqli_query($con, $sql);

         $results = mysqli_fetch_array($result);

         echo json_encode($results);

    }

?>

结果。IE

Client name = YAP KHIN CHOY

Date: 2 June, 2019, 3 June, 2019, 5 June, 2019

Pressing Fetch Button:

Populate the form below with the relevant data.

Answer 1

为了同时解决 sql 漏洞和缺少返回数据（数据未echoed返回到 ajax 函数），以下内容可能会有所帮助<?php&nbsp; &nbsp; require '../db_connection.php';&nbsp; &nbsp; function getclientRecords( $con=false ){&nbsp; &nbsp; &nbsp; &nbsp; $id = isset( $_POST['client_id'] ) ? $_POST['client_id'] : false;&nbsp; &nbsp; &nbsp; &nbsp; if( $con && $id ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql='select `item_date`&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; from `invoice_data`&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; where `client_id`=?';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt=$con->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param( 's', $id );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $result=$stmt->get_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data=[];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while( $rs=$result->fetch_object() ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data[]=$rs->item_date;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->free_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return json_encode( $data );&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; }&nbsp; &nbsp; function getclientRecordByDate( $con=false ){&nbsp; &nbsp; &nbsp; &nbsp; $date = isset( $_POST['date'] ) ? $_POST['date'] : false;&nbsp; &nbsp; &nbsp; &nbsp; $id = isset( $_POST['client_id'] ) ? $_POST['client_id'] : false;&nbsp; &nbsp; &nbsp; &nbsp; if( $con && $id && $date ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql = 'select `client_name`, `item_date`, `item_refe`, `item_parti`, `balance_amount`, `item_amnd`, `item_amnf`, `item_tax`, `item_amniw`, `item_amnif`&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; from `invoice_data`&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; where `item_date` = ? and client_id = ?';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt=$con->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param( 'ss', $date, $id );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $result=$stmt->get_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data=[];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while( $rs=$result->fetch_object() ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data[]=array(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'client_name'&nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp; $rs->client_name,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_date'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp; $rs->item_date,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_refe'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp; $rs->item_refe,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_parti'&nbsp; &nbsp; &nbsp; &nbsp; =>&nbsp; $rs->item_parti,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'balance_amount'&nbsp; &nbsp; =>&nbsp; $rs->balance_amount,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_amnd'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp; $rs->item_amnd,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_amnf'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp; $rs->item_amnf,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_tax'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =>&nbsp; $rs->item_tax,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_amniw'&nbsp; &nbsp; &nbsp; &nbsp; =>&nbsp; $rs->item_amniw,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'item_amnif'&nbsp; &nbsp; &nbsp; &nbsp; =>&nbsp; $rs->item_amnif&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->free_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return json_encode( $data );&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; }&nbsp; &nbsp; $data=[];&nbsp; &nbsp; $action = isset( $_GET['action'] ) ? $_GET['action'] : false;&nbsp; &nbsp; switch( $action ){&nbsp; &nbsp; &nbsp; &nbsp; case 'getclientRecords':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data=getclientRecords($con);&nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; case 'getclientRecordByDate':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data=getclientRecordByDate($con);&nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data=['error'=>'no defined action'];&nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; }&nbsp; &nbsp; header('Access-Control-Allow-Origin: *');&nbsp; &nbsp; http_response_code( $action ? 200 : 400 );&nbsp; &nbsp; exit( $data );?>