php无法执行mysql查询转义

Question

我尝试通过解析 URL 并设置基线来设置查询:

class CatalogHandler extends DB{ 
public function getCatalog(){
    $URL=$_SERVER['REQUEST_URI'];
    $catalog=basename($URL);
    return $catalog;
}
....}

这会返回我需要的“墨盒”所以我设置 mysql 查询来设置页面的元数据

include('CatalogHandler.php');
include('DBconfig.php');

$config = new DBconfig('localhost','setuser','a11235813b','setua');
$catalog = new CatalogHandler($config);
$catalogname=$catalog->getCatalog();
$catalog->openConnection(); //Nothing special just open mysqlconnection
$query="SELECT * FROM metaandtitlecatalogs WHERE Cat in ('".$catalogname."');"; //Problem goes here
$sql=$catalog->query($query); //added to the end of the issue
$hasRows = $catalog->countRows($sql); //here I'm getting Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, boolean given in \home\localhost\www\setua\DB.php
echo "hasrows:".$hasRows;

这是我使用的函数。

class DB{
public function query($query){
    $query = str_replace("}", "", $query);
    $query = str_replace("{", $this->config->prefix, $query);
    try{
        if(empty($this->connection)){
            $this->openConnection();

            if($this->config->connector == "mysql"){
                $this->lastQuery = mysql_query($this->ecapeString($query));
            }
            elseif($this->config->connector == "mysqli"){
                $this->lastQuery = mysqli_query($this->connection, $this->ecapeString($query));
            }
            $this->closeConnection();

            return $this->lastQuery;
        }
        else{
            if($this->config->connector == "mysql"){
                $this->lastQuery = mysql_query($this->ecapeString($query));
            }
            elseif($this->config->connector == "mysqli"){
                $this->lastQuery = mysqli_query($this->connection, $this->ecapeString($query));
            }
            return $this->lastQuery;
        }
    }
    catch(exception $e){
        return $e;
    }
public function countRows($result){
    try{
        if($this->config->connector == "mysql"){
            return mysql_num_rows($result);
        }
        elseif($this->config->connector == "mysqli"){
            return mysqli_num_rows($result);
        }
    }
    catch(exception $e){
        return $e;
    }
}
}

}

我认为这很重要，如果查询变成“...Where ID in (1)”，一切都会顺利进行。这可能是转义的问题，就好像插入了硬编码名称而不是出现“.$catalogname.”问题。尝试使用和转义双引号 - 重现:(
直接在数据库中执行此查询会返回适当的结果

Answer 1

您没有显示您的类的方法ecapeString()，但我认为您误解了转义问题。如果连接字符串，则不需要引用整个 sql 语句，而是引用值。在你的情况下，结果语句将类似于

SELECT * FROM metaandtitlecatalogs WHERE Cat in (\'cartridges\'); 

而不是

SELECT * FROM metaandtitlecatalogs WHERE Cat in ('cartridges');

仅使用带有准备好的语句和参数的 mysqli 或 PDO 是一个好主意。