php - ORDER BY 和 WHERE mysql 和 php

Question

使用 where 添加订单时，此代码不起作用。

$sel = "SELECT * FROM items ORDER BY 'item_no' WHERE mainitem_id=".$_GET['cate_id'] ;

Answer 1

$sel = "SELECT * FROM items 
        WHERE mainitem_id='".$_GET['cate_id']."' 
        ORDER BY item_no";

但请注意，您的代码容易受到 SQL 注入的影响。请也解决这个问题。看这里

Answer 2

在查询的末尾使用 ORDER BY：

$sel = "SELECT * FROM items WHERE mainitem_id='".addslashes($_GET['cate_id'])."' ORDER BY item_no;

Answer 3

利用：

$sel = "SELECT * FROM items WHERE mainitem_id=".mysqli_real_escape_string($conn, $_GET['cate_id'])."ORDER BY 'item_no'" ;

mysqli_real_escape_string()将保护您免受 sql 注入。

获取变量更容易发生sql注入。所以请检查http://php.net/manual/en/security.database.sql-injection.php

Answer 4

$cate_id = mysql_real_escape_string($_GET['cate_id']); //or any proper similar function (mysqli recommended)
$sel = "SELECT * FROM items WHERE mainitem_id='$cate_id' ORDER BY 'item_no'";