ORDER BY和WHERE mysql和php

Question

此代碼在通過where命令添加命令時不起作用。

$sel = "SELECT * FROM items ORDER BY 'item_no' WHERE mainitem_id=".$_GET['cate_id'] ; 

Answer 1

使用ORDER BY你查詢的末尾：

$sel = "SELECT * FROM items WHERE mainitem_id='".addslashes($_GET['cate_id'])."' ORDER BY item_no; 

Answer 2

$sel = "SELECT * FROM items 
     WHERE mainitem_id='".$_GET['cate_id']."' 
     ORDER BY item_no"; 

但是請注意，你的代碼是vurnerable到SQL注入。請解決這個問題。見here

Answer 3

用途：

$sel = "SELECT * FROM items WHERE mainitem_id=".mysqli_real_escape_string($conn, $_GET['cate_id'])."ORDER BY 'item_no'" ; 

mysqli_real_escape_string()會保護你免受SQL注入。

GET變量更容易爲sql injections.So做檢查http://php.net/manual/en/security.database.sql-injection.php

Answer 4

$cate_id = mysql_real_escape_string($_GET['cate_id']); //or any proper similar function (mysqli recommended) 
$sel = "SELECT * FROM items WHERE mainitem_id='$cate_id' ORDER BY 'item_no'";