如果函数里面的sql查询？

Question

function get_tags_by_criteria($gender_id, $country_id, $region_id, $city_id, $day_of_birth=NULL, $tag_id=NULL, $thread_id=NULL) { 

    $query = "SELECT tags.* 
     FROM tags, thread_tag_map, threads 
     WHERE thread_tag_map.thread_id = threads.id 
     AND thread_tag_map.tag_id = tags.id 

     AND threads.gender_id = $gender_id 
     AND threads.country_id = $country_id 
     AND threads.region_id = $region_id 
     AND threads.city_id = $city_id 
     AND tags.id LIKE '%$tag_id%' 
     AND threads.id LIKE '%$thread_id%'"; 
     if(!$day_of_birth) 
     { 
      $query += "AND threads.min_day_of_birth <= '$day_of_birth AND threads.max_day_of_birth >= '$day_of_birth' "; 
     } 

     $query += "GROUP BY tags.name"; 

    $result = $this->do_query($query); 
    return $result; 
} 

如果没有$ day_of_birth作为参数传递，我希望sql忽略if中的2行。我用：

$all_tags = $forum_model->get_tags_by_criteria(1, 1, 0, 0); 

我不知道为什么这个SQL返回一个错误：

Couldn't execute query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '0' at line 1 

Answer 1

您使用的是加法（ +=）运算符时应该使用级联（.=）operator。

你应该逃脱你的投入太大，以避免SQL注入 - 见mysql_real_escape_string()

Answer 2

=用于在PHP字符串连接，而不是+ =

Answer 3

你的问题是，你的出生日期留下了'。

将其更改为AND threads.min_day_of_birth <= '$day_of_birth'（注关闭'开放）
此外，正如其他人所指出的那样，你应该写$query .=代替$query += （注意.）

---

您有SQL注入漏洞;你应该使用参数。
Remember Bobby Tables!

Answer 4

有在附加字符串中缺少“和和之间的空白

Answer 5

您还可以在查询中使用占位符。如果一个选项/参数设置的脚本设置占位符的内容到适当的SQL代码否则占位符是空/空。

例如

function get_tags_by_criteria($gender_id, $country_id, $region_id, $city_id, $day_of_birth=NULL, $tag_id=NULL, $thread_id=NULL) { 
    if (!is_null($day_of_birth)) { 
    $day_of_birth = "AND ('$day_of_birth' BETWEEN threads.min_day_of_birth AND threads.max_day_of_birth)" 
    } 

    $query = " 
    SELECT 
     tags.* 
    FROM 
     tags, thread_tag_map, threads 
    WHERE 
     thread_tag_map.thread_id = threads.id 
     AND thread_tag_map.tag_id = tags.id 
     AND threads.gender_id = $gender_id 
     AND threads.country_id = $country_id 
     AND threads.region_id = $region_id 
     AND threads.city_id = $city_id 
     AND tags.id LIKE '%$tag_id%' 
     AND threads.id LIKE '%$thread_id%' 
     {$day_of_birth} 
    GROUP BY 
     tags.name 
    "; 

    $result = $this->do_query($query); 
    return $result; 
} 

编辑：如前所述：记住可能的sql注入。