使用值的WHERE子句中的字符串 - mysql的

Question

我有值的像一個字符串：

$cat = "1,5,6,8,9"; 

現在我想用在WHERE子句中該變量。我該怎麼做 ？

"select category from test where category...?" 

我使用下面的代碼，但我得到number_of_result變空：

$array_of_cat = explode(",",$cat); 

if($number_of_result == 0){ 
    $mresult = mysql_query("select * from books where 
    GoodName like '%$title%' and GroupCode in ($array_of_cat) "); 
    $number_of_result = mysql_num_rows($mresult); 
} 

Answer 1

將您的SQL語句更改爲此語句。使用implode()通過數組元素IN條款

$mresult = mysql_query(" 
    SELECT * FROM books 
    WHERE GoodName LIKE '%$title%' AND GroupCode IN (" . implode(",", $array_of_cat) . ")"); 

Answer 2

$cat = array(1,5,6,8,9); 

$array_of_cat = implode(",",$cat); 

if($number_of_result > 0){ 
    $mresult = mysql_query("select * from books where 
    GoodName like '%$title%' and GroupCode in ($array_of_cat) "); 

$number_of_result = mysql_num_rows($mresult); 
} 

另外，我強烈建議在PDO/MySQLi

Answer 3

你不讀書了需要分解變量 - 這樣做會導致數組在插入SQL字符串時會導致錯誤的值（字符串「Array」）。

儘管事實上，這是不安全的（SQL injection prone），你可以這樣做：

if($number_of_result == 0){ 
    $mresult = mysql_query("select * from books where 
    GoodName like '%$title%' and GroupCode in ($cat)"); 
    $number_of_result = mysql_num_rows($mresult); 
} 

我強烈建議你使用mysql_real_escape_string功能來準備你的變量。