簡單的PHP變量問題

Question

希望有人能幫助我

我已經聲明的變量

<?php $sitename = "http://" .$_SERVER["SERVER_NAME"]; ?> 

，並想使用該變量在MySQL查詢：

$query_rs_main = "SELECT * FROM g_page WHERE g_page_site = "echo $sitename" AND g_page_url = '/index.asp'"; 

我如何做「echo $ sitename」部分？感謝

Answer 1

$sitename = "http://" .$_SERVER["SERVER_NAME"]; 
$sitename = mysql_real_escape_string($sitename); 
$query_rs_main = "SELECT * FROM g_page WHERE g_page_site = '" . $sitename . "' AND g_page_url = '/index.asp'"; 

Answer 2

$query_rs_main = "SELECT * FROM g_page WHERE g_page_site = '". mysql_real_escape_string($sitename) . "' AND g_page_url = '/index.asp'"; 

兩件事情從此拉開了距離：

1. 你不想給一個變量回聲「變成」一個SQL查詢，這只是沒有任何意義。你想用「。」和字符串的其餘部分連接變量。運營商。

2. 您總是想在將某些東西插入數據庫時​​清理您的輸入。在這種情況下，您想要escape your string以防止SQL injections。

Answer 3

 
$query_rs_main = "SELECT * FROM g_page WHERE g_page_site = '".$sitename."' AND g_page_url = '/index.asp'"; 

Answer 4

$query_rs_main = "SELECT * FROM g_page WHERE g_page_site = $sitename AND g_page_url = '/index.asp'";