語法錯誤或訪問衝突：1064上isset

Question

我不斷收到

'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''5'' at line 5'

與「5」是從下拉框中選擇任何號碼。

這裏是我迄今爲止涉及的問題的代碼。

if (isset($_GET['orderBy']) && $_GET['orderBy'] == 'rank' || $_GET['orderBy'] == 'release_year' || $_GET['orderBy'] == 'author' 
         || $_GET['orderBy']== 'publisher') 

if (isset($_GET['returnLimit']) && $_GET['returnLimit'] == 1 || $_GET['returnLimit'] == 5 || $_GET['returnLimit'] == 10 
           || $_GET['returnLimit'] == 25 || $_GET['returnLimit'] == 50 || $_GET['returnLimit'] == 75 
           || $_GET['returnLimit'] == 100) 
{ 
     try{ 

      $db = new PDO ("mysql:host=localhost;dbname=user", "user", "12345"); 
      $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
      $minimum = $_GET['minimumYear']; 
      $maximum = $_GET['maximumYear']; 
      $order = $_GET['orderBy']; 
      $limit = $_GET['returnLimit']; 

      $q = "SELECT * 
      FROM book 
      WHERE '$minimum' <= '$maximum' 
      ORDER BY '$order' 
      LIMIT '$limit'"; 

      $query = $db->query($q); 
      $statement = $db->prepare($query); 
      $statement->execute(); 

從我得到的，我猜它顯示出來，因爲有被傳遞到$沒有限制數量的錯誤，所以SQL查詢無關「限價」。我檢查過的語法，但無法弄清楚我做錯了什麼，任何幫助將不勝感激。

Answer 1

您的代碼至少有四個主要問題，可能更多。

• 首先，您在LIMIT子句中使用了引號。以及在ORDER BY
• 其次，您沒有使用準備好的語句。
• 第三，這個查詢根本沒有意義。
• 四，錯誤準備的語句語法。

改變你的代碼，以

if (
     isset($_GET['orderBy']) 
    && in_array($_GET['orderBy'], array('rank','release_year','author','publisher')) 
    && isset($_GET['returnLimit'] 
    && in_array($_GET['returnLimit'], array(1,5,10,25,50,75,100)) 
    ) 
{ 
      $db = new PDO ("mysql:host=localhost;dbname=user", "user", "12345"); 
      $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
      $min = $_GET['minimumYear']; 
      $max = $_GET['maximumYear']; 
      $order = $_GET['orderBy']; 
      $limit = $_GET['returnLimit']; 

      $q = "SELECT * FROM book WHERE release_year BETWEEN ? AND ? 
      ORDER BY $order LIMIT $limit"; 

      $statement = $db->prepare($q); 
      $statement->execute(array($min, $max)); 
      $data = $statement->fetchAll();