php - 通过 PHP 变量选择 MySQL 查询

Question

我在 $booked_num 中得到零，我尝试在 SQL 中用值代替变量进行查询，效果很好。但我不知道我哪里出错了，请帮忙。我已经回显了每个变量，一切都很好，但是 $booked_row 中没有任何内容，并且 $booked_num 回显零。

require_once 'mysql_connector.php';
$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;
$booked_num = mysql_num_rows($booked_result);
echo $booked_num;
$booked_row = mysql_fetch_array($booked_result,MYSQL_ASSOC);
print_r($booked_row);

Answer 1

$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;

此语法不正确 - 您需要在连接变量之前关闭字符串。像这样的东西:

$booked_result = mysql_query('select * from booked where train_no = "' .$train_no. '" and date = "' .$date. '" and st_from = "' .$st_from. '" and st_to = "' .$st_to. '";') or die(mysql_error());

此外，您应该考虑切换到 PDO 库。除此之外，它将帮助您避免查询中的 SQL 注入(inject)攻击。