php - 与 php 变量一起使用 LIKE

Question

我在使用 LIKE 处理 PHP 变量时遇到问题。我想根据用户名选择与数据库中的用户名匹配的内容。这是我的代码:

$dbhost = "localhost";
$dbuser = "root";
$dbpass = "1234";
$dbname = "coffeecorner";
$connection = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);

$user = $_SESSION['username'];  

$sql  = "select username ";
$sql .= "from add_reservation";
$sql .= "where username like" . $user;
$result = mysqli_query($connection, $sql);

if(!$result)
{
   die("database query fail!" . mysqli_error($connection));
}

错误

database query fail! You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'likeipin' at line 1

如有任何帮助，我们将不胜感激!

Answer 1

您需要在用户名周围加上引号。另外，如果您使用 LIKE 来匹配模式，则应在其中包含通配符。

$sql .= "where username likem '%$user%'";

但最好使用参数化查询。

$sql = 'SELECT username
        FROM add_reservation
        WHERE username like ?';
$user_pattern = "%$user%";
$stmt = mysqli_prepare($connection, $sql);
mysqli_stmt_bind_param($stmt, "s", $user_pattern);
$result = mysqli_stmt_execute($stmt);
if (!$result) {
    die("database query fail!" . mysqli_error($connection));
}