php - 通过 PHP 变量选择 MySQL 查询

Question

我的分数为零$booked_num，我在 SQL 中尝试了用值代替变量的查询，它工作得很好。但是我不知道我在哪里犯了错误，请帮助。我已经回显了每个变量，一切都很好，但是里面什么都没有，$booked_row并且$booked_num回显为零。

require_once 'mysql_connector.php';
$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;
$booked_num = mysql_num_rows($booked_result);
echo $booked_num;
$booked_row = mysql_fetch_array($booked_result,MYSQL_ASSOC);
print_r($booked_row);

Answer 1

$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;

此语法不正确 - 您需要在连接变量之前关闭字符串。就像是：

$booked_result = mysql_query('select * from booked where train_no = "' .$train_no. '" and date = "' .$date. '" and st_from = "' .$st_from. '" and st_to = "' .$st_to. '";') or die(mysql_error());

此外，您应该考虑切换到 PDO 库。除其他外，它将帮助您避免查询中的 sql 注入攻击。