將變量傳遞給ORDER BY MySQL語句

Question

我想將兩個變量傳遞到ORDER BY $ variable1 $ variable2裏面的MySQL語句。變量從下拉菜單表單中獲得。

PHP

if(isset($_POST['order'])){ 
     $sort1 = mysql_real_escape_string($_POST['sort']); 
     $sort2 = mysql_real_escape_string($_POST['order']); 
     } 
     if(!@$_POST['order']){ 
      $sort1 = 'ID'; 
      $sort2 = 'DESC'; 
     } 
     $topics = mysql_query(" SELECT topic_id AS 'ID', topic_head AS 'Title', 
             topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON' 
           FROM forum_topics 
           ORDER BY '{$sort1}' '{$sort2}' ") or die (mysql_error()); 
         ?> 

HTML表單

<ul class="sort"> 
     <li><form action="topics.php" method="post"> 
       <label class="label">Sort Table By</label> 
       <select name="sort"> 
        <option value =""> </option> 
        <option value ="ID">ID</option> 
        <option value ="Title">Title</option> 
        <option value ="TAGS">TAGS</option> 
        <option value ="VIEWS">VIEWS</option> 
        <option value ="CREATED ON">CREATED ON</option> 
        <option value ="CREATED BY">CREATED BY</option> 
       </select> 

       <label class="label">Order By</label> 

       <select name = "order" class="tap_Select"> 
        <option value =""> </option> 
        <option value ="ASC">Ascending</option> 
        <option value ="DESC">Descending</option> 
       </select> 

       <input type="submit" name="order" value="SORT" > 
      </form> 
     </li> 
    </ul> 

請幫助。

UPDATE

當我刪除約$ SORT1和$ SORT2

報價我得到這個錯誤： You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SORT' at line 4

更新2

當我做了$ SQL =「.....」，而不通過mysql_querry（） 我得到這個

SELECT topic_id AS 'ID', topic_head AS 'Title', topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON' FROM forum_topics ORDER BY ID SORT

Answer 1

請勿使用引號，

ORDER BY 'ID' 'DESC' 

不正確。它應該是

ORDER BY ID DESC 

引號將id和desc轉換爲純字符串，而不是關鍵字/字段名。

Answer 2

刪除括號並添加排序元素之間用逗號

ORDER BY $sort1 $sort2 ") or die (

編輯：進行以下修改，所以我們可以看到這是怎麼回事...

走這條線（S）

$topics = mysql_query(" SELECT topic_id AS 'ID', topic_head AS 'Title', 
            topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON' 
          FROM forum_topics 
          ORDER BY '{$sort1}' '{$sort2}' ") or die (mysql_error()); 

將查詢粘貼到變量中，並將mysql_query中的字符串替換爲變量;

$query="SELECT topic_id AS 'ID', topic_head AS 'Title', 
            topic_tags AS 'TAGS', topic_owner AS 'CREATED BY', topic_date AS 'CREATED ON' 
          FROM forum_topics 
          ORDER BY '{$sort1}' '{$sort2}' "; 
$topics = mysql_query($query) or die (mysql_error()); 

然後回顯查詢並將結果剪切/粘貼到問題中。有些事情沒有按照你認爲的方式發生。

echo $query; 

Answer 3

$topics = mysql_query("SELECT 
    topic_id AS `ID`, 
    topic_head AS `Title`, 
    topic_tags AS `TAGS`, 
    topic_owner AS `CREATED BY`, 
    topic_date AS `CREATED ON` 
FROM forum_topics 
ORDER BY {$sort1} {$sort2}' 
") or die (mysql_error()); 

您需要刪除'各地ORDER BY值。另外請注意首選使用別名值附近的反標記。

還請注意，您應該使用mysqli_ *或PDO作爲mysql_ *已被棄用（請參閱大多數mysql_ *相關功能的PHP.net上的大紅色警告。

Answer 4

看來你的列名包含空格，所以你需要使用反引號：

ORDER BY `{$sort1}` {$sort2} 

還要注意的是mysql_real_escape_string沒有提供任何保護的ORDER BY條款的情況。您需要針對允許輸入的白名單檢查您的輸入。