簡化一個MySQL查詢，可以有多個輸入選項使用php

Question

我有一個腳本，將查詢我的數據庫，並需要能夠使用四個選項中的一個或全部進行查詢。選項是開始sku，結束sku（這是一個選項，因爲必須有一個範圍來搜索），由創建和創建日期。我知道我可以使用很多if..elseif語句來做到這一點，但我必須認爲有更好更簡單的方法。這是我到目前爲止的代碼：

$start =mysql_real_escape_string ($_POST['skuStart']); 
$end = mysql_real_escape_string($_POST['skuEnd']); 
$source = mysql_real_escape_string($_POST['source']); 
$processDate = mysql_real_escape_string($_POST['processDate']); 

if(!empty($start) && !empty($end) && empty($source) && empty($processDate)){ 
$result = $conn->query("Select * from inventory where sku >= $start and sku <= $end"); 

} elseif (empty($start) && empty($end) && !empty($source) && empty($processDate)){ 
$result = $conn->query("Select * from inventory where created_by = '$source'"); 

} elseif (empty($start) && empty($end) && empty($source) && !empty($processDate)) { 
$result = $conn->query("Select * from inventory where date_process = '$processDate'"); 

} elseif(!empty($start) && !empty($end) && !empty($source) && empty($processDate)){ 
$result = $conn->query("Select * from inventory where sku >= $start and sku <= $end and created_by = '$source'"); 

} else { 
$result = $conn->query("Select * from inventory where sku >= '$start' and sku <= '$end' and created_by = '$source' and date_process = '$processDate'"); 
} 

while($row = $result->fetch_assoc()) 
    { 

     $skuArray[$x] = $row['sku']; 
     $isbnArray[$x] = $row['isbn13']; 
     $qtyArray[$x] = $row['quantity']; 
     $defectArray[$x] = $row['defect_id']; 
     $sourceArray[$x] = $row['source_id']; 
     $featureArray[$x] = $row['feature_id']; 
     $locationArray[$x] = $row['location_id']; 
     $processDateArray[$x] = $row['date_process']; 
     $bookTypeArray[$x] = $row['book_type_id']; 
     $createdByArray[$x] = $row['created_by']; 
     $modifiedByArray[$x] = $row['modified_by']; 

     $x++; 

這非常粗糙的形式工作，但有沒有辦法讓if elseif簡化？

注：我知道我應該使用PDO來防止SQL注入，但我還沒有完全瞭解，所以我正在使用這個。

Answer 1

撇開你已經知道的問題 - 切換到PDO和使用綁定參數 - 你可以用下面的使你的代碼更清晰一點：

<?php 

$start   = mysql_real_escape_string ($_POST['skuStart']); 
$end   = mysql_real_escape_string($_POST['skuEnd']); 
$source   = mysql_real_escape_string($_POST['source']); 
$processDate = mysql_real_escape_string($_POST['processDate']); 
$where   = array(); 

if(!empty($start)) 
{ 
    $where[] = 'sku >= ' . $start; 
} 

if(!empty($end)) 
{ 
    $where[] = 'sku <= ' . $end; 
} 

if(!empty($source)) 
{ 
    $where[] = 'created_by = \''.$source .'\''; 
} 

if(!empty($processDate)) 
{ 
    $where[] = 'date_process = \''.$processDate .'\''; 
} 

$query = 'SELECT * FROM inventory'; 

if(count($where)) 
{ 
    $query .= ' WHERE ' . implode(' AND ', $where); 
} 

$result = $conn->query($query); 

while($row = $result->fetch_assoc()) 
    { 

     $skuArray[$x] = $row['sku']; 
     $isbnArray[$x] = $row['isbn13']; 
     $qtyArray[$x] = $row['quantity']; 
     $defectArray[$x] = $row['defect_id']; 
     $sourceArray[$x] = $row['source_id']; 
     $featureArray[$x] = $row['feature_id']; 
     $locationArray[$x] = $row['location_id']; 
     $processDateArray[$x] = $row['date_process']; 
     $bookTypeArray[$x] = $row['book_type_id']; 
     $createdByArray[$x] = $row['created_by']; 
     $modifiedByArray[$x] = $row['modified_by']; 

     $x++; 

Answer 2

$q = array(); 
if (!empty($start)) 
    $q[] = "sku >= '$start'"; 
if (!empty($end)) 
    $q[] = "sku <= '$end'"; 
#... 
$q = join(') AND (', $q); 
$q = "SELECT * FROM inventory WHERE ($q)"; 

，或者你可能會進一步採取這一個步驟：

$params = array(
    'skuStart' => "sku >= '##'", 
    'skuEnd' => "'sku <= '##'", 
    #... 
); 

$q = array(); 
foreach($params as $k=>$sql) { 
    $v = mysql_real_escape_string($_POST[$k]); 
    if (!empty($v)) { 
    $sql = tr_replace('##', $v, $sql); 
    $q[] = $sql; 
    } 
} 
$q = join(') AND (', $q); 

然後你可以驗證添加類型，和其他的東西了提高你的元數據，並建立自己的小框架...

每當你覺得你重複自己，你應該檢查現有的解決方案（庫/框架）或建立你的... DRY。

Answer 3

<?php 
$db = new PDO('mysql:host=localhost;dbname=my_db', 'user', 'passwd'); 

$sql = "SELECT * FROM INVENTORY "; 

$where = array(); 
$params = array(); 
if (! empty($start) && ! empty($end) { 
    $where[] = " sku >= :start AND sku <= :end "; 
    $params['start'] = $start; 
    $params['end'] = $end; 
} 
if (! empty($source)) { 
    $where[] = " created_by = :source "; 
    $params['source'] = $source; 
} 
if (! empty($processDate)) { 
    $where[] = " date_process = :date_process "; 
    $params['date_process'] = $processDate; 
} 

if (! empty($where)) { 
    $sql .= ' WHERE ' . join (' AND ', $where); 
} 

$statement = $db->prepare($sql); 
$statement->execute($params); 

while ($row = $statement->fetch(PDO::FETCH_ASSOC)) { 
    // ... 
} 

Answer 4

您可以使用查詢生成器。例如，如果您不使用任何框架，則可以使用https://github.com/jstayton/QueryBuilder（首先在谷歌中創建）。