CFQUERY到queryExecute：如果SQL字符串中

Question

什么是做什么我<cfquery>即使在queryExecute

CFQUERY

<cfquery name="qry"> 
    SELECT * FROM tbl_products 
    WHERE filed1 = 1 

    <cfif structKeyExists(URL, "test")> 
     AND filed2 = 2 
    </cfif> 

    ORDER BY id DESC 
</cfquery> 

cfexecute

<cfscript> 

    sql = " 
     SELECT * FROM tbl_products 
     WHERE filed1 = 1 
     ORDER BY id DESC 
    "; 

    if (structKeyExists(URL, "test")){ 
     sql = " 
      SELECT * FROM tbl_products 
      WHERE filed1 = 1 
      AND filed2 = 2 
      ORDER BY id DESC 
     "; 
    } 

    qry = queryExecute(
     sql = sql 
    ); 

</cfscript> 

做的最好的办法

I希望我已经解释清楚自己...

Answer 1

您必须建立SQL字符串。也值得传递参数值，以免受到SQL注入的影响。例如：

<cfscript> 
params = {}; 

sql = " 
    SELECT * FROM tbl_products 
    WHERE filed1 = :filed1 
"; 
params["filed1"] = 1; 

if (structKeyExists(URL, "test")){ 
    sql &= "AND filed2 = :filed2 "; 
    params["filed2"] = 2; 
} 

sql &= "ORDER BY id DESC"; 

queryExecute(sql, params); 
</cfscript> 

或者，您可以使用位置参数。

<cfscript> 
params = []; 

sql = " 
    SELECT * FROM tbl_products 
    WHERE filed1 = ? 
"; 
arrayAppend(params, 1); 

if (structKeyExists(URL, "test")){ 
    sql &= "AND filed2 = ? "; 
    arrayAppend(params, 2); 
} 

sql &= "ORDER BY id DESC"; 

queryExecute(sql, params); 
</cfscript> 

这是标签比脚本更好的时代之一。