我如何將變量放入mysql查詢中？

Question

我有兩個變量，這樣

$date1 = $_POST['f_date1']; 
$date2 = $_POST['f_date2']; 

這是把它裏面的正確方法是什麼？

$sql = "SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN '$date1' AND '$date2') 
     GROUP BY location 
     ORDER BY Referrals DESC"; 

Answer 1

你做到這一點的方法取決於你使用MySQL的什麼接口。

如果您使用的是（過時且不適用）mysql_*界面（你也不要），然後在最低，你用你的變量之前，你需要使用mysql_real_escape_string()逃避它們。

如：

$date1 = mysql_real_escape_string($_POST['f_date1']); 
$date2 = mysql_real_escape_string($_POST['f_date2']); 

之後是查詢建設是罰款（此方法，你不應該使用）。

理想情況下，您需要使用PDO或mysqli，它們都支持預準備語句。這個例子將是PDO，因爲。在查詢的

$pdo = new PDO('mysql:host=localhost;dbname=whatever', 'username', 'password'); 

$stmt = $pdo->prepare("SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN :startDate AND :endDate) 
     GROUP BY location 
     ORDER BY Referrals DESC"); 

$stmt->execute(array(
    'startDate' => $date1, 
    'endDate' => $date2 
)); 

注意使用:startDate和:endDate。那些是由關聯數組傳遞給$stmt->execute的佔位符。預先準備好的語句是首選，因爲它們可以防止簡單地將unsanitised值連接到查詢中時可能出現的混亂（查找：sql注入）。

mysqli_界面更接近不贊成的mysql_界面，但它也支持預處理語句。

mysqli的方法：

$mysqli = new mysqli('localhost', 'username', 'password', 'db'); 

$stmt = $mysqli->prepare("SELECT location, COUNT(*) as Referrals, 
      SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
      SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
      FROM vtiger_leadscf 
      LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
      WHERE location > '' AND (date_table BETWEEN ? AND ?) 
      GROUP BY location 
      ORDER BY Referrals DESC"); 

$stmt->bind_param("ss", $date1, $date2); 

$stmt->execute(); 

注意的關鍵區別有使用?作爲佔位符（PDO也支持這一點，我只是更喜歡命名佔位符）的方式，以及這些變量的約束。 "ss"指定被綁定的值的「類型」。

我個人偏好是PDO，純粹是因爲我更喜歡用數組參數調用execute。

Answer 2

這樣：

$sql = "SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN '" . $date1 . "' AND '" . $date2 . "') 
     GROUP BY location 
     ORDER BY Referrals DESC";