SELECT语句PDO将一个变量添加到ORDER BY子句

Question

我想添加选项以选择通过使用下拉列表来排列SELECT语句的内容。我以前工作的SELECT语句将从我的表中选择数据，并按点排序。现在，我希望能够通过点或目标，或协助订购等等等等

这里是我以前的工作声明：

$query = $db->prepare("SELECT player_stats.*, teams.* 
         FROM player_stats 
         LEFT JOIN teams ON player_stats.tid = teams.teamid 
         WHERE season = :season 
         ORDER BY points DESC 
         LIMIT 20"); 
$query->bindParam(':season', $season); 
$query->execute(); 
$result = $query->fetchAll(); 

以前的工作方式：

<form action= "<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" method="get" id="search"> 
    <select name='statsYear' id='statsYear' class='dropDown' onchange='this.form.submit()'> 
     <option <?php if (($_GET['statsYear'] == '20162017') || !isset($_GET['statsYear'])) { ?>selected="true" <?php }; ?>value="20162017">2016-2017</option> 
     <option <?php if ($_GET['statsYear'] == '20152016') { ?>selected="true" <?php }; ?>value="20152016">2015-2016</option> 
     <option <?php if ($_GET['statsYear'] == '20142015') { ?>selected="true" <?php }; ?>value="20142015">2014-2015</option> 
     <option <?php if ($_GET['statsYear'] == '20132014') { ?>selected="true" <?php }; ?>value="20132014">2013-2014</option> 
     <option <?php if ($_GET['statsYear'] == '20122013') { ?>selected="true" <?php }; ?>value="20122013">2012-2013</option> 
    </select> 
</form> 

这里是我的新选择STAGE给出了不正确的输出。我将分享一个链接到不正确输出以后：

$query = $db->prepare("SELECT player_stats.*, teams.* 
          FROM player_stats 
          LEFT JOIN teams ON player_stats.tid = teams.teamid 
          WHERE season = :season 
          ORDER BY :statstype DESC 
          LIMIT 20"); 
    $query->bindParam(':season', $season); 
    $query->bindParam(':statstype', $statsType); 
    $query->execute(); 
    $result = $query->fetchAll(); 
    echoTable($result); 

上面的查询不承认新$statsType变量。这是我需要帮助的地方。下面是引用我的新形式和变量声明：

if (isset($_GET['statsType'])) { 
    $statsType = $_GET['statsType']; 
} else {  
    $statsType = 'points' ; 
} 

<form action= "<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" method="get" id="search"> 
    <select name='statsYear' id='statsYear' class='dropDown' onchange='this.form.submit()'> 
     <option <?php if (($_GET['statsYear'] == '20162017') || !isset($_GET['statsYear'])) { ?>selected="true" <?php }; ?>value="20162017">2016-2017</option> 
     <option <?php if ($_GET['statsYear'] == '20152016') { ?>selected="true" <?php }; ?>value="20152016">2015-2016</option> 
     <option <?php if ($_GET['statsYear'] == '20142015') { ?>selected="true" <?php }; ?>value="20142015">2014-2015</option> 
     <option <?php if ($_GET['statsYear'] == '20132014') { ?>selected="true" <?php }; ?>value="20132014">2013-2014</option> 
     <option <?php if ($_GET['statsYear'] == '20122013') { ?>selected="true" <?php }; ?>value="20122013">2012-2013</option> 
    </select> 
     <select name="statsType" id="statsType" class="dropDown" onchange='this.form.submit()'> 
     <option <?php if ($_GET['statsType'] == 'points' || !isset($_GET['statsType'])) { ?>selected="true" <?php }; ?> value="points">Points</option> 
     <option <?php if ($_GET['statsType'] == 'goals') { ?>selected="true" <?php }; ?> value="goals">Goals</option> 
     <option <?php if ($_GET['statsType'] == 'assists') { ?>selected="true" <?php }; ?>value="assists">Assists</option> 
     <option <?php if (($_GET['statsType'] == 'pim')) { ?>selected="true" <?php }; ?>value="pim">PIM</option> 
     <option <?php if ($_GET['statsType'] == 'pm') { ?>selected="true" <?php }; ?>value="pm">+/-</option> 
     <option <?php if (($_GET['statsType'] == 'toi')) { ?>selected="true" <?php }; ?>value="toi">TOI</option> 
    </select> 
</form> 

这是查询应该是什么样子，如果我在表单中选择助攻：
这是实际的输出：
http://sjsharktank.com/leaders.php?statsYear=20162017&statsType=assists

Answer 1

你不能使用参数列..你应该使用（最终）字符串连接并建立SQL命令dinamically

但要小心的SQL注入

$query = $db->prepare("SELECT player_stats.*, teams.* 
          FROM player_stats 
          LEFT JOIN teams ON player_stats.tid = teams.teamid 
          WHERE season = :season 
          ORDER BY " . $statstype . " DESC 
          LIMIT 20"); 

如果你可以使用双引号的嵌套报价限制使用送花儿给人同样的

$query = $db->prepare('SELECT player_stats.*, teams.* 
          FROM player_stats 
          LEFT JOIN teams ON player_stats.tid = teams.teamid 
          WHERE season = :season 
          ORDER BY ' . $statstype . ' DESC 
          LIMIT 20'); 

你也可以用双引号和PHP魔术行为工作vars

$query = $db->prepare("SELECT player_stats.*, teams.* 
          FROM player_stats 
          LEFT JOIN teams ON player_stats.tid = teams.teamid 
          WHERE season = :season 
          ORDER BY $statstype DESC 
          LIMIT 20");