使用select語句和php變量插入到MySQL

Question

我看起來像這樣。它應該插入這些值，但我不能讓ID的由php插入。我無法得到正確的語法，請幫助。

---

$insertQuery = "insert into appointment (appointmentID, doctorid, appointmentDate, symptoms, patientid, time) 
    values($id,(select doctorid from doctors where doctorName like '$docName'),$date,$symptoms, 
    (select patientid from patient where patientFName like '$nameOfUser'),$time)"; 

---

我得到一個無效的查詢錯誤，但是當我vardump THES變量($docName, $id, $nameOfUser)他們變成是在正確的格式。我已經嘗試在MySQL表中手動輸入，並且它已成功插入。

Answer 1

首先，您通過使用(select patientid from patient where patientFName like '$nameOfUser')來選擇已經使用的ID而犯了一個錯誤。我建議patientid是主鍵和整數數據類型。

當您創建一個表。使用此語法使其自動增加：

CREATE TABLE example (
    id MEDIUMINT NOT NULL AUTO_INCREMENT, 
    name CHAR(30) NOT NULL, 
    PRIMARY KEY (id) 
) ENGINE=MyISAM; 

而當您插入表中時，您不必插入id。數據庫引擎會自動計算最後一個ID。

INSERT INTO example(name)values('example'); 

但是！如果你已經不auto_increment命令創建這個表，你必須使用這個表「太遠」，只要使用此解決方案：

mysql_connect('your host','database user','password'); 
mysql_select_db('your database name'); 
$query=mysql_query('SELECT MAX(patientid) FROM yourtable;'); 
$read_id = mysql_fetch_row($query)); 
$next_id = $read_id[0] + 1; 
$query = mysql_query('INSERT INTO yourtable(patientid)values('.$next_id.');'); 

欲瞭解更多信息，瞭解它here

Answer 2

$insertQuery = "INSERT INTO appointment 
    (appointmentID 
    , doctorid 
    , appointmentDate 
    , symptoms 
    , patientid 
    , time 
    ) 
SELECT '" . $id . "' 
    , n.doctorid 
    , '" . $date . "' 
    , '". $symptoms ."' 
    , p.patientid 
    FROM (SELECT e.doctorid 
      FROM doctors e 
      WHERE e.doctorName LIKE '" . $docName . "' 
      LIMIT 1 
     ) d 
CROSS 
    JOIN (SELECT q.patientid 
      FROM patient q 
      WHERE q.patientName LIKE '" . $nameOfUser ."' 
      LIMIT 1 
     ) p "; 

這種說法是主題到SQL注入。爲了緩解這種情況，您需要轉義包含在SQL文本中的「不安全」值，或者使用帶有綁定佔位符的準備好的語句。

假設你正在使用的mysqli接口的程序風格的功能，連接被命名爲$con

$insertQuery = "INSERT INTO appointment 
    (appointmentID 
    , doctorid 
    , appointmentDate 
    , symptoms 
    , patientid 
    , time 
    ) 
SELECT '" . mysqli_real_escape_string($con, $id) . "' 
    , n.doctorid 
    , '" . mysqli_real_escape_string($con, $date) . "' 
    , '" . mysqli_real_escape_string($con, $symptoms) ."' 
    , p.patientid 
    FROM (SELECT e.doctorid 
      FROM doctors e 
      WHERE e.doctorName LIKE '" . mysqli_real_escape_string($con, $docName) . "' 
      LIMIT 1 
     ) d 
CROSS 
    JOIN (SELECT q.patientid 
      FROM patient q 
      WHERE q.patientName LIKE '" . mysqli_real_escape_string($con, $nameOfUser) ."' 
      LIMIT 1 
     ) p "; 

已準備語句會使用綁定的佔位符代替文字：

$insertQuery = "INSERT INTO appointment 
    (appointmentID 
    , doctorid 
    , appointmentDate 
    , symptoms 
    , patientid 
    , time 
    ) 
SELECT ? 
    , n.doctorid 
    , ? 
    , ? 
    , p.patientid 
    FROM (SELECT e.doctorid 
      FROM doctors e 
      WHERE e.doctorName LIKE ? 
      LIMIT 1 
     ) d 
CROSS 
    JOIN (SELECT q.patientid 
      FROM patient q 
      WHERE q.patientName LIKE ? 
      LIMIT 1 
     ) p ";