PHP - 麻煩與SQL查詢

Question

我有這個疑問：

SELECT * FROM items WHERE itemcategory= 123 AND itemname LIKE '%abc%'; 

我想傳遞參數給itemcategory和itemname;我試過這樣的：

SELECT * FROM items WHERE itemcategory=".'$categoryid'." AND itemname LIKE" ."'%$itemname%'"." AND shopid=5003; 

它沒有工作。誰能幫忙？

Answer 1

你在做什麼幾乎是正確的，但你可以去字符串連接複雜的是，如果你還記得$var在雙引號字符串自動擴展

因此，這是更容易閱讀和通知間距的問題，這是我認爲這是不對您的發言

$q = "SELECT * 
     FROM items 
     WHERE itemcategory = '$categoryid' 
      AND itemname LIKE '%$itemname%' 
      AND shopid=5003"; 

假設你有這些變量的有效數據這應該工作

The only danger with doing this rather than using prepared parameterised queries is that you risk SQL Injection Attack Have a look at what happened to Little Bobby Tables Even if you are escaping inputs, its not safe! Use prepared statement and parameterized statements