0

我有一个 SQL 查询，我想在其中选择在两个日期之间支付的记录。

这是我构建查询的方式：

$qry = array();
    $qry[] = "SELECT DISTINCT 2 AS Record_Type, wp_woocommerce_order_items.order_id As Order_Id, First_Name;
    $qry[] = "FROM  wp_woocommerce_order_items";
    $qry[] = "LEFT JOIN (SELECT meta_value As First_Name, post_id FROM wp_postmeta WHERE meta_key = '_shipping_first_name') AS a";
    $qry[] = "ON wp_woocommerce_order_items.order_id = a.post_id";
    $qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > " .$_POST['debut'] . " AND meta_value < " . $_POST['fin'] . ") AS m";
    $qry[] = "ON wp_woocommerce_order_items.order_id = m.post_id";
    $qry[] = "WHERE wp_woocommerce_order_items.order_item_type = 'line_item'";
    $qry[] = "ORDER BY wp_woocommerce_order_items.order_id";

问题在于我在 RIGHT JOIN 行中的 POST 变量。如果我硬编码一个日期而不是 $_POST['debut'] 和 $_POST['fin'] 我得到我正在寻找的结果。

所以我想我的问题在于我的 PHP POST 变量的连接。

任何人都可以帮助我吗？

4

2 回答 2

3

您需要引用您的价值观，例如，而不是

$qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > " .$_POST['debut'] . " AND meta_value < " . $_POST['fin'] . ") AS m";

采用

$qry[] = "RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > '" .$_POST['debut'] . "' AND meta_value < '" . $_POST['fin'] . "') AS m";

并请寻找mysql_real_escape_string或其他方式来避免 SQL 注入攻击。

于 2013-05-28T14:45:07.950 回答
1

用这个

$qry[] = "SELECT DISTINCT 2 AS Record_Type, wp_woocommerce_order_items.order_id As Order_Id, First_Name
    FROM  wp_woocommerce_order_items
    LEFT JOIN (SELECT meta_value As First_Name, post_id FROM wp_postmeta WHERE meta_key = '_shipping_first_name') AS a
    ON wp_woocommerce_order_items.order_id = a.post_id
    RIGHT JOIN (SELECT post_id FROM wp_postmeta WHERE meta_key = '_paid_date' AND meta_value > '" .$_POST['debut'] . "' AND meta_value < '" . $_POST['fin'] . "'') AS m
    ON wp_woocommerce_order_items.order_id = m.post_id
    WHERE wp_woocommerce_order_items.order_item_type = 'line_item'
    ORDER BY wp_woocommerce_order_items.order_id";
于 2013-05-28T14:51:05.233 回答