PHP MYSQL無法執行查詢：未知列

Question

請幫我弄清楚這一點。第一個查詢將返回一個消息，說

Couldn't execute query: Unknown column 'ssd23' in 'where clause. 

ssd23是$_POST將獲得來自HTML表單的pnumber值。但是，如果只有數字，它將起作用。

$result = mysqli_query($con, "DELETE FROM Tools WHERE PartNumber = {'$_POST['pnumber']'}") or die ("Couldn't execute query: " .mysqli_error($con)); 

下面的第二個查詢可以在使用變量後使用數字和字符。

​​

Answer 1

替換此：

$result = mysqli_query($con, "DELETE FROM Tools WHERE PartNumber = {'$_POST['pnumber']'}") or die ("Couldn't execute query: " .mysqli_error($con)); 

有了這個：

$result = mysqli_query($con, "DELETE FROM Tools WHERE PartNumber = '" . $_POST['pnumber'] ."'") or die ("Couldn't execute query: " .mysqli_error($con)); 

通知我並沒有採取上述

甚至更​​好的照顧SQL注入的是使用準備報表這將保護您的querys，你的情況會是這樣的：

$sql= 'DELETE FROM Tools WHERE PartNumber= ?';  

$stmt = $con->prepare($sql); 
$stmt->bind_param('i', $_POST['pnumber']); 
$stmt->execute();