WHERE子句語法

Question

怎麼了我的sysntax，我不明白。有沒有更好的辦法？

<? 
      $uid = $_GET["uid"]; 
      $month= $_GET["month"]; 
      $year = $_GET["year"]; 
      $query = "SELECT taskname,uid,month,year, SUM(tasktime) FROM tictoc WHERE uid = $uid, month = $month, year = $year GROUP BY taskname"; 

      $result = mysql_query($query) or die(mysql_error()); 

      // Print out result 
      while($row = mysql_fetch_array($result)){ 
       echo "<br />"; 
       echo "Total ". $row['taskname']. " = <strong>". $row['SUM(tasktime)']."</strong>"; 
       echo "<br />"; 
      } 
      ?> 

錯誤是：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' month = 'Aug', year = '2012' GROUP BY taskname' at line 1 

Answer 1

您需要使用AND，而不是一個逗號，像這樣：

select taskname, uid, month, year, SUM(tasktime) 
from tictoc 
where uid = $uid 
    and month = $month 
    and year = $year 
group by taskname 

另外，還要注意行：

echo "Total ". $row['taskname']. " = <strong>". $row['SUM(tasktime)']."</strong>"; 

不管用。您需要別名查詢和參考的總和該別名，就像這樣：

SELECT taskname,uid,month,year, SUM(tasktime) as SumTaskTime 

然後執行：

echo "Total ". $row['taskname']. " = <strong>". $row['SumTaskTime)']."</strong>"; 

Answer 2

爲了補充以前的答案，檢查參數沒有到達空。例如：

$uid = $_GET["uid"] = $_GET["uid"] == "" ? 0 : $_GET["uid"]; 
$month = $_GET["month"] = $_GET["month"] == "" ? 0 : $_GET["month"]; 
$year = $_GET["year"] = $_GET["year"] == "" ? 0 : $_GET["year"]; 

或選擇您的檢查策略。

原因是，如果他們到達空，而您沒有驗證它，您將錯誤地構建您的SQL語句，並且您將有您報告的錯誤。