如何通过Ajax将review.php的$companyid传递到submit_rating.php

核心实现逻辑：将PHP端生成的$companyid注入前端可访问的位置，所有发往后端的Ajax请求携带该参数，后端从请求参数中读取ID替换硬编码值即可，同时修复原有代码的安全隐患与逻辑bug。

1. 前端（review.php）注入企业ID供JS读取 #

在现有HTML容器内添加隐藏域存储企业ID，放在评论模块容器最外层即可，避免JS读取不到：

<input type="hidden" id="current_company_id" value="<?php echo htmlspecialchars($companyid); ?>">

不想加DOM节点的话，也可以直接在脚本块开头定义JS常量：const COMPANY_ID = <?php echo json_encode($companyid); ?>;

2. 修改Ajax请求，统一携带company_id参数 #

从代码结构判断你使用jQuery实现Ajax逻辑，所有请求submit_rating.php的接口（页面初始加载拉取评分、提交新评论两个场景）都要新增company_id参数，参考示例：

$(document).ready(function(){
    // 读取页面存储的企业ID
    const companyId = $('#current_company_id').val();

    // 1. 页面加载时拉取对应企业的评分、评论数据
    load_rating_data();
    function load_rating_data(){
        $.ajax({
            url: "submit_rating.php",
            method: "POST",
            data: {
                action: "fetch_data",
                company_id: companyId // 新增传参
            },
            dataType: "JSON",
            success: function(data){
                // 原有渲染平均分、星级进度条、评论列表的逻辑保持不变
                $('#average_rating').text(data.average_rating);
                $('#total_review').text(data.total_review);
                $('#total_five_star_review').text(data.five_star_review);
                // 其余DOM渲染逻辑...
            }
        })
    }

    // 2. 提交新评论时携带企业ID
    $('#add_review').click(function(){
        // 原有弹窗、表单取值逻辑保持不变
        $.ajax({
            url: "submit_rating.php",
            method: "POST",
            data: {
                rating_data: $('input[name=rating]:checked').val(),
                user_name: $('#user_name').val(),
                user_review: $('#user_review').val(),
                company_id: companyId // 新增传参
            },
            success: function(response){
                alert(response);
                $('#review_modal').modal('hide');
                load_rating_data(); // 提交后重新拉取最新评分
            }
        })
    }
})

3. 后端（submit_rating.php）替换硬编码，修复安全问题 #

删除原有硬编码的$companyid = "118";，替换为从POST参数读取ID，同时修复原代码的SQL注入漏洞、PDO参数绑定错误、除0报错问题：

<?php
//submit_rating.php
// 从POST参数读取企业ID，做整数校验拦截非法请求
$companyid = isset($_POST['company_id']) ? intval($_POST['company_id']) : 0;
if($companyid <= 0){
    echo "参数错误";
    exit;
}

$connect = new PDO("mysql:host=localhost;dbname=你的数据库名", "数据库账号", "数据库密码");

if(isset($_POST["rating_data"]))
{
    $data = array(
        ':user_name'        =>  $_POST["user_name"],
        ':user_rating'      =>  $_POST["rating_data"],
        ':user_review'      =>  $_POST["user_review"],
        ':datetime'         =>  time(),
        ':company_id'       =>  $companyid // 修正原代码键名缺少冒号的绑定错误
    );
    
    $query = "
    INSERT INTO client_reviews 
    (user_name, user_rating, user_review, datetime, company_id) 
    VALUES (:user_name, :user_rating, :user_review, :datetime, :company_id)
    ";

    $statement = $connect->prepare($query);
    $statement->execute($data);

    echo "评论与评分提交成功";

}

if(isset($_POST["action"]))
{
    $average_rating = 0;
    $total_review = 0;
    $five_star_review = 0;
    $four_star_review = 0;
    $three_star_review = 0;
    $two_star_review = 0;
    $one_star_review = 0;
    $total_user_rating = 0;
    $review_content = array();

    // 替换原有的字符串拼接SQL，改用PDO预处理避免SQL注入
    $query = "SELECT * FROM client_reviews WHERE company_id = :companyid ORDER BY review_id DESC";
    $statement = $connect->prepare($query);
    $statement->execute([':companyid' => $companyid]);
    $result = $statement->fetchAll(PDO::FETCH_ASSOC);

    foreach($result as $row)
    {
        $review_content[] = array(
            'user_name'     =>  $row["user_name"],
            'user_review'   =>  $row["user_review"],
            'rating'        =>  $row["user_rating"],
            'datetime'      =>  date('Y年m月d日 h:i:s A', $row["datetime"])
        );

        switch($row["user_rating"]){
            case 5: $five_star_review++; break;
            case 4: $four_star_review++; break;
            case 3: $three_star_review++; break;
            case 2: $two_star_review++; break;
            case 1: $one_star_review++; break;
        }

        $total_review++;
        $total_user_rating += $row["user_rating"];
    }

    // 修复0评论时的除0报错
    $average_rating = $total_review > 0 ? $total_user_rating / $total_review : 0;

    $output = array(
        'average_rating'    =>  number_format($average_rating, 1),
        'total_review'      =>  $total_review,
        'five_star_review'  =>  $five_star_review,
        'four_star_review'  =>  $four_star_review,
        'three_star_review' =>  $three_star_review,
        'two_star_review'   =>  $two_star_review,
        'one_star_review'   =>  $one_star_review,
        'review_data'       =>  $review_content
    );

    echo json_encode($output);
}
?> 

额外修复的原有代码问题 #

• 修正插入数据时PDO参数数组中company_id键名缺少冒号导致的绑定失败问题
• 替换字符串拼接SQL的写法，全部改用PDO预处理，避免SQL注入风险
• 新增企业ID合法性校验，拦截非法参数请求
• 新增0评论场景的除0错误处理，避免无评论时出现PHP警告

内容的提问来源于stack exchange，提问作者Abbas Hassan