0

我想知道是否有人可以帮助我。以下代码将生成 type = bus 但不会仅生成已批准 = 1 的所有用户。如果有人能指出我的错误，我将不胜感激。搜索查询是由某人通过表单在文本框中输入一个词触发的，这部分工作正常，只有在配置文件中具有搜索词的用户才会出现，并且只有 type=bus 但已批准 = 1 的用户似乎没有效果，并且退货全部批准，我真的希望有人可以提供帮助。

$query = "select * from users where type='bus' and approved=1 and
name like \"%$trimmed%\"  
or profile_words like \"%$trimmed%\"  
or full_name like \"%$trimmed%\"  
or tag_line like \"%$trimmed%\"  
or referral like \"%$trimmed%\"  
or profession like \"%$trimmed%\"  
order by full_name";
4

4 回答 4

1

像这样分组你的条件，

$query = "
select *
from users 
where  type='bus' and 
       approved = 1 and
          (
             name like \"%$trimmed%\" or 
             profile_words like \"%$trimmed%\"  or 
             full_name like \"%$trimmed%\"   or 
             tag_line like \"%$trimmed%\"  or 
             referral like \"%$trimmed%\" or 
             profession like \"%$trimmed%\
          )
order by full_name";

我有一个建议给你，请使用PDO或MySQLI扩展来避免 SQL 注入。

PDO 示例，

<?php

$query = "
select *
from users 
where  type='bus' and 
       approved = 1 and
          (
             name like ? or 
             profile_words like ?  or 
             full_name like ?   or 
             tag_line like ?  or 
             referral like ? or 
             profession like ?
          )
order by full_name";

$name = '%' . $trimmed . '%';

$stmt = $dbh->prepare($query);
$stmt->bindParam(1, $name);
$stmt->bindParam(2, $name);
$stmt->bindParam(3, $name);
$stmt->bindParam(4, $name);
$stmt->bindParam(5, $name);
$stmt->bindParam(6, $name);

$stmt->execute();

?>
于 2012-08-24T08:35:54.080 回答
0 
$query = "select * from users where type='bus' and approved=1 and
(name like \"%$trimmed%\"  
or profile_words like \"%$trimmed%\"  
or full_name like \"%$trimmed%\"  
or tag_line like \"%$trimmed%\"  
or referral like \"%$trimmed%\"  
or profession like \"%$trimmed%\")  
order by full_name";

?

于 2012-08-24T08:35:43.770 回答
0

我认为您的批准部分很好，但我认为问题可能出在OR. 尝试通过分隔AND和OR语句来放置括号，如下所示：

$query = "select * from users where type='bus' and approved=1 and
( name like \"%$trimmed%\"  
or profile_words like \"%$trimmed%\"  
or full_name like \"%$trimmed%\"  
or tag_line like \"%$trimmed%\"  
or referral like \"%$trimmed%\"  
or profession like \"%$trimmed%\" )  
order by full_name";
于 2012-08-24T08:37:14.300 回答
0

将您的 where 运算符括起来。目前你正在

where (type='bus' and approved=1)
or .... [all the other operators]
于 2012-08-24T08:40:28.973 回答