'SQLSTATE [HY093]：無效的參數編號：參數未定義'

Question

我不斷收到上述錯誤。這是我設立在那裏發生的事情：

$InsertSQL = "insert into reports.NonVarassetInvoices(State, CLLI, Type, Vendor, DateReceived, InvoiceNumber, InvoiceDate, TotalInvoiceAmount, ProjectWONumber, CAF, SentForApprovalDate, Approver 
      , ApprovalReceivedDate, ReleaseDate, ReleaseNumber, SentToAPDate, InvoicerName, Status, HoldReason, Notes) 
select ':State', ':CLLI', (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Value = ':Type') order by Sequence) 
    , ':Vendor', ':DateReceived', ':InvoiceNumber', ':InvoiceDate', :TotalInvoiceAmount, ':ProjectWONumber', ':CAF', ':SentForApprovalDate', ':Approver' 
    , ':ApprovalReceivedDate', ':ReleaseDate', ':ReleaseNumber', ':SentToAPDate', ':InvoicerName' 
    , (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Value = ':Status') order by Sequence) 
    , (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Value = ':HoldReason') order by Sequence), ':Notes'"; 

$stmt = $conn->prepare($InsertSQL); 

$stmt->bindParam(':State', $State, PDO::PARAM_STR); 
$stmt->bindParam(':CLLI', $CLLI, PDO::PARAM_STR); 
$stmt->bindParam(':Type', $Type, PDO::PARAM_INT); 
$stmt->bindParam(':Vendor', $Vendor, PDO::PARAM_STR); 
$stmt->bindParam(':DateReceived', $DateReceived, PDO::PARAM_STR); 
$stmt->bindParam(':InvoiceNumber', $InvoiceNumber, PDO::PARAM_STR); 
$stmt->bindParam(':InvoiceDate', $InvoiceDate, PDO::PARAM_STR); 
$stmt->bindParam(':TotalInvoiceAmount', $TotalInvoiceAmount, PDO::PARAM_INT); 
$stmt->bindParam(':ProjectWONumber', $ProjectWONumber, PDO::PARAM_STR); 
$stmt->bindParam(':CAF', $CAF, PDO::PARAM_STR); 
$stmt->bindParam(':SentForApprovalDate', $SentForApprovalDate, PDO::PARAM_STR); 
$stmt->bindParam(':Approver', $Approver, PDO::PARAM_STR); 
$stmt->bindParam(':ApprovalReceivedDate', $ApprovalReceivedDate, PDO::PARAM_STR); 
$stmt->bindParam(':ReleaseDate', $ReleaseDate, PDO::PARAM_STR); 
$stmt->bindParam(':ReleaseNumber', $ReleaseNumber, PDO::PARAM_STR); 
$stmt->bindParam(':SentToAPDate', $SentToAPDate, PDO::PARAM_STR); 
$stmt->bindParam(':InvoicerName', $InvoicerName, PDO::PARAM_STR); 
$stmt->bindParam(':Status', $Status, PDO::PARAM_INT); 
$stmt->bindParam(':HoldReason', $HoldReason, PDO::PARAM_INT); 
$stmt->bindParam(':Notes', $Notes, PDO::PARAM_STR); 

$stmt->execute(); 

我也曾嘗試做execute(array(':State => $State ...));我得到同樣的錯誤。

我不知道這是什麼意思，但我看過其他幾個類似名稱的問題。據我所知，他們不回答我確切的問題。

我錯過了什麼嗎？我該如何解決？

UPDATE

我已經基於以下答案更新了我的插入SQL：

$InsertSQL = "insert into reports.NonVarassetInvoices(State, CLLI, Type, Vendor, DateReceived, InvoiceNumber, InvoiceDate, TotalInvoiceAmount, ProjectWONumber, CAF, SentForApprovalDate, Approver 
                   , ApprovalReceivedDate, ReleaseDate, ReleaseNumber, SentToAPDate, InvoicerName, Status, HoldReason, Notes) 
        select :State, :CLLI, (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Name = 'NonVInvoiceType') Value = :Type and IsActive = 1) 
         , :Vendor, :DateReceived, :InvoiceNumber, :InvoiceDate, :TotalInvoiceAmount, :ProjectWONumber, :CAF, :SentForApprovalDate, :Approver 
         , :ApprovalReceivedDate, :ReleaseDate, :ReleaseNumber, :SentToAPDate, :InvoicerName 
         , (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Name = 'NonVStatus') and Value = :Status and IsActive = 1) 
         , (select Id from pmdb.PicklistChild where ParentId in(select Id from pmdb.PicklistParent where Name = 'NonVHoldReason') and Value = :HoldReason and IsActive = 1), :Notes"; 

現在，我得到了500 Internal Server Error消息和空白屏幕。如果我把Params到執行語句是這樣的：

$stmt->execute(array(':State'=>$State,':CLLI'=>$CLLI,':Type'=>$Type,':Vendor'=>$Vendor,':DateReceived'=>$DateReceived,':InvoiceNumber'=>$InvoiceNumber,':InvoiceDate'=>$InvoiceDate 
         ,':TotalInvoiceAmount'=>$TotalInvoiceAmount,':ProjectWONumber'=>$ProjectWONumber 
         ,':CAF'=>$CAF,':SentForApprovalDate'=>$SentForApprovalDate,':Approver'=>$Approver,':ApprovalReceivedDate'=>$ApprovalReceivedDate,':ReleaseDate'=>$ReleaseDate 
         ,':ReleaseNumber'=>$ReleaseNumber,':SentToAPDate'=>$SentToAPDate 
         ,':InvoicerName'=>$InvoicerName,':Status'=>$Status,':HoldReason'=>$HoldReason,':Notes'=>$Notes)); 

然後我得到這個錯誤：

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: [Microsoft][ODBC Driver 11 for SQL Server][SQL Server]Incorrect syntax near 'Value'

Answer 1

你居然沒有在SQL語句中的任何參數;他們都是文字字符串作爲你引述他們：

... where Value = ':Type' ... 
       ^ ^these need to go 

所以，你需要刪除所有這些單引號包圍的佔位符。

除此之外，你只能使用值的佔位符，而不是列名，表名等

所以這不會不帶引號工作，要麼：

... select ':State', ':CLLI' ... 

在變量的情況下，列名稱，您需要將它們插入字符串中，並且爲了避免sql注入，您需要首先檢查它們是否在白名單中。

// check all column names agains a white-list 
... 
// insert them into your string 
... select `{$State}`, `{$CLLI}` ... 
// etc.