Question

無論我改變什麼，我都會繼續運行此代碼並獲取相同的錯誤。

require('common.php'); 
$charname = $_SESSION['user']['username']; 
$query = "SELECT group, guild, username, class, level 
     FROM DD_users 
     WHERE username = '".$charname."'"; 
try 
{ 
// These two statements run the query against your database table. 
$stmt = $db->prepare($query); 
$stmt->execute(); 
} 
catch(PDOException $ex) 
{ 
// Note: On a production website, you should not output $ex->getMessage(). 
// It may provide an attacker with helpful information about your code. 
die("Failed to run query: " . $ex->getMessage()); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

//print_r($rows); 
$group = $rows['0']['adminaccess']; 
$guild = $rows['0']['guild']; 
$username = $rows['0']['username']; 
$class = $rows['0']['class']; 
$level = $rows['0']['level']; 

它返回該錯誤
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'group, guild, username, class, level FROM DD_users ' at line 1 而且很顯然，我需要更多的文字可以編輯這個...

Answer 1

試試這個：

$query = "SELECT group, guild, username, class, level FROM DD_users WHERE username = '".$charname."'";

注意額外報價'。如果您查詢字符串，則它們是必需的。

另外：group可能是一個保留關鍵字。您需要使用`-style quotes或.brackets [來逃避。嘗試它的工作原理

Answer 2

關注，該集團的關鍵字被保留，試圖封閉它反引號`

Answer 3

你忘了'字符：

$query = "SELECT group, guild, username, class, level 
      FROM DD_users 
      WHERE username = '".$charname."'"; 

Answer 4

像下面這樣將節省你的單引號的麻煩 - 但更重要的是它還可以防範SQL注入攻擊。你從來沒有想要輸入並將其直接推入SQL查詢字符串。可怕的事情會發生。

請注意查詢字符串中的?標記，並通過$charname值來代替?通過execute(array($charname))調用。這樣做的事情會讓底層庫代碼在查詢中安全地引用$ charname。

require('common.php'); 
$charname = $_SESSION['user']['username']; 
$query = "SELECT `group`, guild, username, class, level 
      FROM DD_users 
      WHERE username = ?"; 
try 
{ 
    // These two statements run the query against your database table. 
    $stmt = $db->prepare($query); 
    $stmt->execute(array($charname)); 
} 
catch(PDOException $ex) 
{ 
    // Note: On a production website, you should not output $ex->getMessage(). 
    // It may provide an attacker with helpful information about your code. 
    die("Failed to run query: " . $ex->getMessage()); 
} 

// Finally, we can retrieve all of the found rows into an array using fetchAll 
$rows = $stmt->fetchAll(); 

print_r($rows);