2014-10-28 37 views

回答

0

使用PDO結果:

$query = $db->query("SELECT `prs_amtdb` FROM prs WHERE `prs_amtcrck` = 0"); 
$results = $query->fetchAll(); 

foreach($results as $result) { 
    echo $result; 
} 

http://php.net/manual/en/pdo.query.php

如果您有查詢中使用的用戶輸入信息,則應始終使用prepared statements例如:

$query = $db->prepare("SELECT `prs_amtdb` FROM prs WHERE `prs_amtcrck` = :atmcrck"); 
$query->bindParam(':atmcrck', 0); // 0 will be the user input 
$query->execute();  
$results = $query->fetchAll(); 

foreach($results as $result) { 
    echo $result; 
} 

確保在PDO有一個數據庫連接設置:

try { 
    $dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass); 
} catch (PDOException $e) { 
    die($e->getMessage()); 
} 

http://php.net/manual/en/pdo.connections.php

+1

我很欣賞沒有必要對固定值使用參數化,但值得指出的是,如果零來自用戶輸入,參數化從安全角度來看是個好主意。 – halfer 2014-10-28 09:14:26

0

使用的mysqli

注:確保你綁定你的價值。 mysqli不會自動 保護您的查詢 $ connection = mysqli_connect($ host,$ user,$ password,$ database);

$query="SELECT prs_amtdb FROM prs WHERE prs_amtcrck = 0"; 

$result= mysqli_query($connection, $query);//$connection is your database 

//connection 

//fetch the result 

while($row= mysqli_fetch_array($result)){ 
     echo $row['column_name'].'<br/>'; 
}