使用WHERE和

Question

下面是我的模型的代碼，我使用的是笨多參數SQL語法無效，我敢肯定有它一個簡單的問題，但我一直在努力了很長一段時間，任何想法？

<?php 
    class Users_model extends CI_Model { 

    public function __construct() { 
     parent::__construct(); 
     $this->load->database(); 
    } 

    public function checkLogin($username, $pass) { 
     $sql = "SELECT COUNT(*) FROM Users WHERE username=? AND password=?;"; 
     $query = $this->db->query($sql, $username, sha1($pass)); 

     if ($query -> num_rows() == 1) { 
      return True; 
     } else { 
      return False; 
     } 
    } 
    } 
?> 

錯誤：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? AND password=?' at line 1

Answer 1

如果$this->db是PDO object，比its query method不允許使用參數綁定。

您將不得不使用prepared statement。您的代碼將如下所示：

$sql = "SELECT COUNT(*) as count FROM Users WHERE username=:user AND password=:pass"; 
$sth = $this->db->prepare($sql); 
$sth->execute(array(':user' => $username, ':pass' => sha1($pass))); 
$count = $sth->fetch(PDO::FETCH_COLUMN, 'count'); 

Answer 2

今天我發現下面的工作，SQL語句的參數只需要在一個數組中。

$query = $this->db->query($sql, array($username, sha1($pass)));