PHP：不能通過單引號字符串mysqli的查詢

Question

我用這個簡單的事情爭取時間：

$var=var;  
$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' "; 

我得到的錯誤是：您的SQL語法錯誤;檢查對應於您的MySQL服務器版本的手冊，以在第1行'\'var \'附近使用正確的語法。

名稱是正確的，它在mysql查詢中起作用。想想我嘗試了所有可能的引用選項，有什麼不對？

更新：根據要求我用了逃逸，但仍錯誤相同

$var=var; 
$var = $conn->real_escape_string($var); 
$result = "SELECT column1, column2 FROM {$db} WHERE column3 = '{$var}' "; 

Answer 1

必須有

$var = $mysqli->real_escape_string($var); 
$sql = "SELECT column1, column2 FROM {$db} WHERE column3 = '{$var}' "; 

相反的：

$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' "; 
$result = $mysqli->real_escape_string($result) ; //Totally wrong. 

Answer 2

我在MySQL控制檯測試帶有錯誤的SQL查詢：

mysql> SELECT column1, column2 FROM WHERE column3 = 'varvalue'; 

它給這個錯誤：

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE column3 = 'varvalue'' at line 1 

事實上表名丟失。我猜你的變量$ db可能是null/empty/unset。

請嘗試：

$db = "mytable"; 
$var = "varvalue"; 
$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' ";