为什么这段PHP代码不起作用？

问题描述

|

<?PHP
require_once($_SERVER[\'DOCUMENT_ROOT\'].\'/api_config.PHP\');

error_reporting(E_ALL);
ini_set(\"display_errors\",1);
$loc = $_POST[\'u\'];

//initialize the connection to the database
$config = $config[\'production\'];
$con = MysqL_connect($config[\'db\'][\'host\'],$config[\'db\'][\'username\'],$config[\'db\'][\'password\']) or die (\"Unable to connect\");
MysqL_select_db ($config[\'db\'][\'dbname\'],$con) or die (\"Unable to select database\");
$query = \"SELECT `location` FROM `active_users` WHERE name = \'$loc\'\";
$result = MysqL_query($query,$con) or die (\"Unable to run query\");

if (MysqL_num_rows($result) > 0) { 
// yes,the user esists
    header(\"HTTP/1.0 200 Success\"); 
    header(\'Content-Type: text/plain\');
} else 
// no,user doesn\'t exist 
    header(\"HTTP/1.0 404 Not Found\");
    header(\'Content-Type: text/plain\');
} 
MysqL_close($con);

?>

我的浏览器出现一个“ѭ1”错误。为什么？     

解决方法

        您忘记打开the2ѭ。     ,        您也没有在清理您的输入-您正在执行大概由用户输入的原始SQL。转这个：

$query = \"SELECT `location` FROM `active_users` WHERE name = \'$loc\'\";

进入

$query = \"SELECT `location` FROM `active_users` WHERE name = \'\".mysql_real_escape_string($loc).\"\'\";