用mysql準備

Question

我使用mysqli的準備準備查詢準備查詢但這給了一個錯誤 檢查對應於你的MySQL服務器版本正確的語法使用near '? ) AND ( user_fullname ? )'

$query="DELETE FROM table WHERE ( quiz_answer ? ) AND (user_fullname ?)"; 
    $stmt = $mysqli->prepare($query); 


    $stmt->bind_param('ss',array('IS NULL','IS NULL')); 
    $stmt->execute(); 

請幫助手冊我在查詢中發現問題 在此先感謝

Answer 1

如果我們假設，$ answer和$ fullname是您的quiz_answer和user_fullname參數。 這可能會實現：

$answerString = 'IS NULL'; 
$userString = 'IS NULL'; 

if (trim($answer) && $answer != 'null') $answerString = '= ?'; 
if (trim($user) && $user != 'null') $userString = '= ?'; 

$query="DELETE FROM table WHERE ( quiz_answer $answerString ) AND (user_fullname $userString)"; 

$stmt = $mysqli->prepare($query); 

if ($answer && ! $fullname) $stmt->bind_param('s',array($answer)); 
if ($answer && $fullname) $stmt->bind_param('ss',array($answer, $fullname)); 
if (! $answer && $fullname) $stmt->bind_param('s',array($fullname)); 

$stmt->execute(); 

，但我也建議更多的PARAM驗證被甚至參數結合將它們插入到SQL查詢之前執行。