0

This is sort of a follow up to my last question (http://stackoverflow.com/questions/12945119/mysql-function-add-prices-from-multiple-tables ) so the MySQL code is there. My background with DBs is all SQL Server 2008 and Access, so the idiosyncrasies of MySQL are getting the better of me. I've Googled my brains out, read every even vaguely relevant Q&A on StackOverflow, StackExchange's programming and webdeveloper boards, etc. (Had to get that disclaimer out of the way.)

I ran the function in DreamCoder and when it just prompts me for intput and then runs the function, it returns the correct answer (a decimal,) so the function's logic is sound as far as I can tell. However, when I try to call the function from PHP, it errors out.

The DB access code is as follows:

function getQuote($json)

echo("JSON input: ");
var_dump($json);

    $array = json_decode($json, TRUE);
    echo("JSON decoded array: ");
    print_r($array);

    $cheese = $array[0];
    $meat = $array[1];
    $veg = $array[2];   

    $c = db_connect();
    $query = "SELECT calculatePrice($cheese, $meat, $veg)";
    var_dump($query);
    $result  = mysql_query($query , $c);
    if(!$result)
    {
        echo "\nCould not successfully run query ($query) from DB: " . mysql_error();
        exit;
    }

if (mysql_num_rows($result) == 0) {
    echo "No rows found, nothing to print so am exiting";
    exit;
}

while($row = mysql_fetch_assoc($result)){
    echo("Row: ");
    var_dump($row);

    if(!$row)
        die("No price returned!" . var_dump($row));
    else
    {   
        return json_encode($row);   
    }
}  //end while

And I wrote the following "test harness" to manually feed it data. I know the JSON's going in right because the full code gives the same error verbatim, so the issues's either PHP or MySQL.

    <?php
        require_once 'DBUtils.php';

    $array = array();
    $array[] = "Chedder";
    $array[] ="Ham";
    $array[] ="Carrot";

    $json = json_encode($array);
    echo("JSON object:");
    var_dump($json);

    $test = getQuote($json);

        echo("Test: ");
        print_r($test);

    ?>

I've also tried MySQLi, same deal, same error. According to MySQL's documentation, scant as it is, I'm calling the function properly and passing the variables correctly. (PHP's documentation on such is virtually non-existent; their examples all amount to "SELECT * from tblFoo WHERE bar=4.")

The error is that it treats chedder as a column name rather than as the variable: "Unknown column 'cheddar' in 'field list'". What am I missing?

I could do this in SQLServer and ASP.NET without batting an eye, but MySQL/PHP is confusing the penguins out of me X_X (Not Linux penguins, just the zoo kind.)

PHP version is 5.3.17, MySQL is 5.1 in case either makes a difference. I think PHP 5.4.* has some relevant methods, but before I go through the hassle of changing my PHP version, I'd rather exhaust any 5.3.* options first.

I'm well-aware the answer is probably obvious, and know there's no one who'll outdo me for calling myself stupid once I learn what I'm doing.

Thank you again! This site is darned near my go-to before Google for questions ^_^ (And at least 2/3 of the results for any Google question I ask come from here anyway =-p )

EDIT: OK the MySQL works alone (SELECT from etc...) Turns out it wanted ' vs. `.

4

1 回答 1

1

由于 SQL 字符串注入和缺少占位符，该程序正在传递一个虚假的查询字符串。

SELECT calculatePrice(Cheddar, Ham, Carrot);

..不是有效的 SQL：那些应该是字符串文字，而不是 [unbound] 列标识符。

扩展： MySQL 在这里需要一个 Column 或一个 Expression 并且Cheddar, Ham, 和Carrot不是当前 SQL 语句中的列。它们也不是表达式（如'Cheddar'或1 + 41）。这就是错误消息显示"Unknown column 'cheddar'" 的原因，因为此语句中没有绑定这样的列。

虽然确保函数获取字符串值的一种方法'是在 SQL 语句的生成中添加 s，但此处描述了更好的方法。

另外，验证它是否也不需要结果列名，例如，至少在 SQL Serverselect calculatePrice(..) as colName中是必需的 ..

于 2012-10-19T01:38:03.083 回答