如何修复window.history.replaceState引发的PHP未定义数组键Sort警告

问题根源 #

你添加的history.replaceState代码会修改浏览器历史记录，将POST提交后的URL替换为无POST参数的版本。当用户刷新页面时，浏览器会发送GET请求而非重复提交POST，此时$_POST['Sort']不存在，触发Undefined array key警告。而移除JS后，刷新时浏览器会提示重新提交POST，$_POST['Sort']存在，因此无报错。但本质问题是PHP代码未处理$_POST['Sort']不存在的场景。

修复步骤 #

1. 修复PHP端的未定义键警告

给$_POST['Sort']设置默认值，同时处理非法排序值，避免SQL逻辑异常：

function recipe_list_dishes() {
    $con = mysqli_connect("localhost", "root", "", "cookbook");
    // 用null合并运算符设置默认排序（PHP7+支持），若POST无Sort参数则用默认值
    $sort = $_POST["Sort"] ?? "alphabet_p";

    switch ($sort) {
        case "alphabet_p":
            $sql = "SELECT * FROM product WHERE type = $dish_type ORDER BY name";
            break;
            
        case "alphabet_rev_p":
            $sql = "SELECT * FROM product WHERE type = $dish_type ORDER BY name DESC";
            break;
        // 处理非法排序值， fallback到默认排序
        default:
            $sql = "SELECT * FROM product WHERE type = $dish_type ORDER BY name";
            break;
    }

    // 执行查询（原代码缺失此步骤，需补充）
    $result = mysqli_query($con, $sql);
    // ... 后续处理查询结果的逻辑

    mysqli_close($con);
}               

2. 修复HTML中select的selected判断

同样处理$_POST['Sort']不存在的情况，确保默认选项正确选中：

<form method="POST" id="form" enctype='multipart/form-data'>
    Sort:
    <select name="Sort" onchange="form.submit();" id="sort">
        
        <optgroup label="Alphabetically">
            <option value="alphabet_p" <?php if(($_POST['Sort'] ?? 'alphabet_p') == 'alphabet_p') {echo "selected=selected"; } ?>> 
                A-Z
            </option>

            <option value="alphabet_rev_p" <?php if(($_POST['Sort'] ?? 'alphabet_p') == 'alphabet_rev_p') {echo "selected=selected"; } ?>>
                Z-A
            </option>
        </optgroup>
    </select>
</form>

3. 额外修复：SQL注入风险

原代码中$dish_type直接拼接进SQL，存在注入风险，建议改用预处理语句：

// 替换switch中的SQL部分
switch ($sort) {
    case "alphabet_p":
        $sql = "SELECT * FROM product WHERE type = ? ORDER BY name";
        break;
        
    case "alphabet_rev_p":
        $sql = "SELECT * FROM product WHERE type = ? ORDER BY name DESC";
        break;
    default:
        $sql = "SELECT * FROM product WHERE type = ? ORDER BY name";
        break;
}
// 预处理绑定参数
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, "s", $dish_type); // 若$dish_type是数字则用"i"
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

内容的提问来源于stack exchange，提问作者Gibon