我如何将变量放入mysql查询中？

Question

我有两个变量，这样

$date1 = $_POST['f_date1']; 
$date2 = $_POST['f_date2']; 

这是把它里面的正确方法是什么？

$sql = "SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN '$date1' AND '$date2') 
     GROUP BY location 
     ORDER BY Referrals DESC"; 

Answer 1

你做到这一点的方法取决于你使用MySQL的什么接口。

如果您使用的是（过时且不适用）mysql_*界面（你也不要），然后在最低，你用你的变量之前，你需要使用mysql_real_escape_string()逃避它们。

如：

$date1 = mysql_real_escape_string($_POST['f_date1']); 
$date2 = mysql_real_escape_string($_POST['f_date2']); 

之后是查询建设是罚款（此方法，你不应该使用）。

理想情况下，您需要使用PDO或mysqli，它们都支持预准备语句。这个例子将是PDO，因为。在查询的

$pdo = new PDO('mysql:host=localhost;dbname=whatever', 'username', 'password'); 

$stmt = $pdo->prepare("SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN :startDate AND :endDate) 
     GROUP BY location 
     ORDER BY Referrals DESC"); 

$stmt->execute(array(
    'startDate' => $date1, 
    'endDate' => $date2 
)); 

注意使用:startDate和:endDate。那些是由关联数组传递给$stmt->execute的占位符。预先准备好的语句是首选，因为它们可以防止简单地将unsanitised值连接到查询中时可能出现的混乱（查找：sql注入）。

mysqli_界面更接近不赞成的mysql_界面，但它也支持预处理语句。

mysqli的方法：

$mysqli = new mysqli('localhost', 'username', 'password', 'db'); 

$stmt = $mysqli->prepare("SELECT location, COUNT(*) as Referrals, 
      SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
      SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
      FROM vtiger_leadscf 
      LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
      WHERE location > '' AND (date_table BETWEEN ? AND ?) 
      GROUP BY location 
      ORDER BY Referrals DESC"); 

$stmt->bind_param("ss", $date1, $date2); 

$stmt->execute(); 

注意的关键区别有使用?作为占位符（PDO也支持这一点，我只是更喜欢命名占位符）的方式，以及这些变量的约束。 "ss"指定被绑定的值的“类型”。

我个人偏好是PDO，纯粹是因为我更喜欢用数组参数调用execute。

Answer 2

这样：

$sql = "SELECT location, COUNT(*) as Referrals, 
     SUM(CASE WHEN leadstatus = 'Hired' THEN 1 ELSE 0 END) as Hired, 
     SUM(CASE WHEN leadstatus = 'Failed' THEN 1 ELSE 0 END) as Failed 
     FROM vtiger_leadscf 
     LEFT JOIN vtiger_leaddetails ON vtiger_leadscf.leadid = vtiger_leaddetails.leadid 
     WHERE location > '' AND (date_table BETWEEN '" . $date1 . "' AND '" . $date2 . "') 
     GROUP BY location 
     ORDER BY Referrals DESC";