SQL語法錯誤 - 不知道爲什麼得到這個？

Question

我能不知道這一點，由於某種原因，即時得到此錯誤消息：

Database query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND ptb_block_user.blocked=1' at line 5 

，這是我的MySQL查詢，不知道是什麼問題，請有人可以幫助我嗎？

function blocked_users() { 
      global $connection; 
      global $_SESSION; 
      global $profile_id; 
      $query = "SELECT * 
         FROM ptb_block_user 
         WHERE ptb_block_user.blocked_id = \"$profile_id\" 
         AND ptb_block_user.user_id = ".$_SESSION['user_id']." 
         AND ptb_block_user.blocked='1' "; 
         $blocked_users = mysql_query($query, $connection); 
      confirm_query($blocked_users); 
      return $blocked_users; 

     } 

Answer 1

你總是可以做一個print $query太瞭解SQL查詢的樣子。發現錯誤會更容易。

Answer 2

function blocked_users() { 
      global $connection; 
      global $_SESSION; 
      global $profile_id; 
      $query = "SELECT * 
         FROM ptb_block_user 
         WHERE ptb_block_user.blocked_id = ".mysql_real_escape_string($profile_id)." 
         AND ptb_block_user.user_id = ".mysql_real_escape_string($_SESSION['user_id'])." 
         AND ptb_block_user.blocked=1;"; 
      $blocked_users = mysql_query($query, $connection); 
      confirm_query($blocked_users); 
      return $blocked_users; 
     } 

使用的mysqli的lib爲mysql：http://www.php.net/manual/en/book.mysqli.php

Answer 3

SELECT * 
    FROM ptb_block_user b 
WHERE b.blocked_id = '$profile_id' 
    AND b.user_id = '{$_SESSION['user_id']}' 
    AND b.blocked=1 

？

Answer 4

如果你使用普通的php而沒有框架，sou應該總是使用準備好的語句進行mysql通信。這是更安全的，並保護你免受mysql注入。

試試這個。

db = new mysqli("your_ip_or_host","username","password","name_of_database"); 
$st = $db->prepare("SELECT * 
        FROM ptb_block_user 
        WHERE ptb_block_user.blocked_id = ? 
        AND ptb_block_user.user_id = ? 
        AND ptb_block_user.blocked=?"); 

$st->bind_param('iii', intval($profile_id), intval($_SESSION['user_id']),1); 

$st->execute(); 

$st->store_result(); 
$st->bind_result($col1, $col2, ... , $colx); 

while($st->fetch()) 
{ 
    echo "col1=$col, col2=$col2, ...., colX=$colx \n"; 
} 

$st->close();