PHP：不能通过单引号字符串mysqli的查询

Question

我用这个简单的事情争取时间：

$var=var;  
$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' "; 

我得到的错误是：您的SQL语法错误;检查对应于您的MySQL服务器版本的手册，以在第1行'\'var \'附近使用正确的语法。

名称是正确的，它在mysql查询中起作用。想想我尝试了所有可能的引用选项，有什么不对？

更新：根据要求我用了逃逸，但仍错误相同

$var=var; 
$var = $conn->real_escape_string($var); 
$result = "SELECT column1, column2 FROM {$db} WHERE column3 = '{$var}' "; 

Answer 1

必须有

$var = $mysqli->real_escape_string($var); 
$sql = "SELECT column1, column2 FROM {$db} WHERE column3 = '{$var}' "; 

相反的：

$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' "; 
$result = $mysqli->real_escape_string($result) ; //Totally wrong. 

Answer 2

我在MySQL控制台测试带有错误的SQL查询：

mysql> SELECT column1, column2 FROM WHERE column3 = 'varvalue'; 

它给这个错误：

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE column3 = 'varvalue'' at line 1 

事实上表名丢失。我猜你的变量$ db可能是null/empty/unset。

请尝试：

$db = "mytable"; 
$var = "varvalue"; 
$result = "SELECT column1, column2 FROM $db WHERE column3 = '$var' ";