PHP PDO語句引發致命錯誤

Question

我有一個函數，它在語法問題上拋出了一個不尋常的錯誤。看一看。

public static function authenticate($_user, $_pass) 
    { 
     $sql = 'SELECT password, key 
       FROM users 
       WHERE username = ' . $_user; 

     $stm = Db::init()->prepare($sql); 
     if ($stm->execute()) 
      return $stm->fetch(PDO::FETCH_ASSOC);  
    } 

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key FROM users WHERE username = testuser1' at line 1' in /class.php:111

Stack trace:
#0 /class.php(111): PDOStatement->execute()
#1 /class.php(118): Password::authenticate('testuser1', 'test')
#2 {main} thrown in /class.php on line 111

任何想法，這是什麼意思？

Answer 1

key是sql中的保留字。在查詢中用反引號括起來。像這樣：

public static function authenticate($_user, $_pass) 
    { 
     $sql = 'SELECT password, `key` 
       FROM users 
       WHERE username = ' . $_user; 

     $stm = Db::init()->prepare($sql); 
     if ($stm->execute()) 
      return $stm->fetch(PDO::FETCH_ASSOC);  
    } 

BTW：您的代碼中存在SQL注入漏洞。使用參數化查詢來綁定$_user的值。