传递字符串时PHP MySQL查询错误

Question

您好，我遇到一个 MySQL 查询未传递字符串变量的问题。

如果 $pass 只包含数字，它工作正常。当它包含字母时，我得到 Cannot execute the query 错误。

例子:

$pass=123456     //works fine
$pass=z23456     //cannot execute the query
$_SESSION['id']=$pass;           //start session

if (isset($_SESSION['id'])) {

// Query database for user information.
$query = "SELECT RepName FROM RepTable WHERE RepNumber = 
".$_SESSION['id']."";
$result = mysql_query ($query) OR die ('Cannot execute the query.');
$rinfo = mysql_fetch_array ($result);
$RepInfo = $rinfo[0]; 

Answer 1

尝试:

'".$_SESSION['id']."'"

代替:

".$_SESSION['id'].""

您还可以添加:

mysql_escape_string($_SESSION['id'])