作者qazsd (nice play!)
看板PHP
標題[請益] 這兩段原始碼的差別
時間Sun Nov 4 20:48:51 2007
以下這段 (簡稱A)
<?php require_once('../Connections/TravelSite.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "",
$theNotDefinedValue = "")
{
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
$theValue = function_exists("mysql_real_escape_string") ?
mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" :
"NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}
}
mysql_select_db($database_TravelSite, $TravelSite);
$query_ch14_filedownload = "SELECT * FROM ch14_uploadtoserver ORDER BY
Fs_Date DESC";
$ch14_filedownload = mysql_query($query_ch14_filedownload, $TravelSite) or
die(mysql_error());
$row_ch14_filedownload = mysql_fetch_assoc($ch14_filedownload);
$totalRows_ch14_filedownload = mysql_num_rows($ch14_filedownload);
?>
跟以下這段 (簡稱B)
<?php require_once('../Connections/TravelSite.php'); ?>
<?php
mysql_select_db($database_TravelSite, $TravelSite);
$query_ch14_filedownload = "SELECT * FROM ch14_uploadtoserver ORDER BY
Fs_Date DESC";
$ch14_filedownload = mysql_query($query_ch14_filedownload, $TravelSite) or
die(mysql_error());
$row_ch14_filedownload = mysql_fetch_assoc($ch14_filedownload);
$totalRows_ch14_filedownload = mysql_num_rows($ch14_filedownload);
?>
感覺好像就是A段比B段
多了
if (!function_exists("GetSQLValueString")) {....(以下略)綠色那段(簡稱C)
而有沒有那C段，似乎都可以從資料庫裡撈到資料
那想請問那C段有什麼作用呢
PS:那段是用DW8建立資料集就會自動產生的。
--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 59.127.20.190
※ 編輯: qazsd 來自: 59.127.20.190 (11/04 20:52)
1F：推 JeffMcBride:簡單來說 要防止SQL injection 有錯請指正:p 11/04 23:03
2F：→ JeffMcBride:和確保變數型態是SQL語法用的 11/04 23:04