將MySQL查詢轉換爲可能的空值的預準備語句

Question

爲了防止sql注入，我將查詢轉換爲預準備語句。我剩下一個。它也包含一個可能的空值，因此證明有點困難。

正常：

// Declare $dbc, $varA, $varB, $varC, $ID 

$varC = ($varC == '-') ? "NULL" : "'" . $varC . "'"; 

$query = "UPDATE myTable "; 
$query .= "SET VARA = '{$varA}', VARB = '{$varB}', VARC = $varC "; 
$query .= "WHERE ID = '{$ID}'"; 

$result = @mysqli_query($dbc, $query) or die("Error updating record: " . mysqli_error($dbc)); 

嘗試在事先準備好的聲明：

// Declare $dbc, $varA, $varB, $varC, $ID 

$varC = ($varC == '-') ? "NULL" : "'" . $varC . "'"; 

$query = "UPDATE myTable "; 
$query .= "SET VARA = ? VARB = ? VARC = ? "; 
$query .= "WHERE ID = ?"; 

$stmt = mysqli_prepare($dbc, $query); 
$bind = mysqli_stmt_bind_param($stmt, "ssss", $varA, $varB, $varC, $ID); 
$exec = mysqli_stmt_execute($stmt); 
mysqli_stmt_close($stmt); 

Answer 1

爲什麼不

$varC = ($varC == '-') ? null : $varC; 

？

而且，你缺少的逗號查詢

$query .= "SET VARA = ?, VARB = ?, VARC = ? "; 

編輯： 我只是跑了我的變化的代碼，它似乎工作好。作爲參考，這是我使用的代碼：

<?php 
error_reporting(-1); 
ini_set('display_errors', 'On'); 

$dbc = mysqli_connect("127.0.0.1", "test", "test", "test"); 


$ID = "1"; 
$varA = "a"; 
$varB = "b"; 
$varC = "-"; 

$varC = ($varC == '-') ? null : $varC; 

$query = "UPDATE myTable "; 
$query .= "SET VARA = ?, VARB = ?, VARC = ? "; 
$query .= "WHERE ID = ?"; 

$stmt = mysqli_prepare($dbc, $query); 
$bind = mysqli_stmt_bind_param($stmt, "ssss", $varA, $varB, $varC, $ID); 
$exec = mysqli_stmt_execute($stmt); 
mysqli_stmt_close($stmt); 

你能嘗試添加錯誤報告行代碼的頂部，看看你得到任何錯誤？