php - 插入和选择嵌套查询中的 SQL 语法错误

Question

我有这个问题:

$FullName = mysql_real_escape_string($_REQUEST['name']);
$EmailAdd = mysql_real_escape_string($_REQUEST['email_address']);
$City = mysql_real_escape_string($_REQUEST['city']);
$State = mysql_real_escape_string($_REQUEST['state']);

$SqlEInsert= "INSERT INTO `td_email` VALUES ((SELECT ownerid FROM 'td_events' where event_id = '$EvID'),'$EmailAdd','$FullName', '$City'  ,'$State')";

$RsEmail = mysql_query($SqlEInsert) or die('Error :' . mysql_error());

但是当我运行应用程序时出现以下错误

Error :You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''td_events' where event_id = '394'),'email@hotmail.com','Full Name', 'Atl' at line 1

Answer 1

当你想使用引号时，你不需要 ' 作为表名，那么你必须使用 `

$SqlEInsert= "INSERT INTO td_email VALUES ((SELECT ownerid FROM td_events WHERE event_id = '$EvID'),'$EmailAdd','$FullName', '$City'  ,'$State')";

请看一下 SQL 注入(inject)和安全

$SqlEInsert= "INSERT INTO td_email VALUES ((SELECT ownerid FROM td_events WHERE event_id = '".(int)$EvID."'),'".mysql_real_escape_string($EmailAdd)."','".mysql_real_escape_string($FullName)."', '".mysql_real_escape_string($City)."'  ,'".mysql_real_escape_string($State)."')";