从PHP错误执行MySQL查询

Question

我的这部分代码会创建这样的多个查询：

$sql = ""; 

$sql .= "INSERT INTO projects 
     (project_id, project_name, project_description, project_deadline, project_status, project_priority) 
     VALUES ('" . $project_id . "', '" . $name . "', '" . $description . "', '" . $final_deadline . "', '" . $status . "', '" . $priority . "');"; 

foreach($assignments as $assigned_user) 
{ 
    $sql .= "INSERT INTO assignments 
      (user_id, project_id, assigned_date) 
      VALUES ('" . $assigned_user . "', '" . $project_id . "', '" . time() . "');"; 
} 

$result = mysql_query($sql) or die(mysql_error()); 

但是，我得到一个错误：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'INSERT INTO assignments (user_id, project_id, assigned_date) ' at line 3

然而，如果我赞同$sql原来是这样的：

INSERT INTO projects (project_id, project_name, project_description, project_deadline, project_status, project_priority) VALUES ('7090', 'Sup :D', 'OMG!', '716770800', '1', '1'); 
INSERT INTO assignments (user_id, project_id, assigned_date) VALUES ('12', '7090', '1284139311'); 
INSERT INTO assignments (user_id, project_id, assigned_date) VALUES ('11', '7090', '1284139311'); 

THEN我ma最终将SQL执行到PhpMyAdmin，它工作正常，但是当PHP执行它并输出错误时它怎么不起作用？

Answer 1

mysql_query只能在一个时间

执行一个查询试试这个：

$sql = "INSERT INTO projects 
     (project_id, project_name, project_description, project_deadline, project_status, project_priority) 
     VALUES ('" . $project_id . "', '" . $name . "', '" . $description . "', '" . $final_deadline . "', '" . $status . "', '" . $priority . "');"; 
$result = mysql_query($sql) or die(mysql_error()); 

foreach($assignments as $assigned_user) 
{ 
    $sql = "INSERT INTO assignments 
      (user_id, project_id, assigned_date) 
      VALUES ('" . $assigned_user . "', '" . $project_id . "', '" . time() . "');"; 
    $result = mysql_query($sql) or die(mysql_error()); 
} 

Answer 2

多个查询不由的mysql_query功能的支持。检查的mysqli :: multi_query

http://php.net/manual/en/mysqli.multi-query.php

Answer 3

我的猜测是的mysql_query函数将不允许多条语句的执行，每个语句将需要单独执行。

虽然看大图，请考虑以下发布：Overwriting data in a MySQL table。总之，通过串联字符串来构建查询是一种灾难，您将很容易受到SQL注入攻击和其他错误的攻击。考虑使用PDO抽象层，而不是调用mysql特定的函数，并且使用参数化查询而不是像你一样构建字符串。

这是初学者犯的一个标准错误（没有网上的大量例子以及书中给出的指导很差的帮助），所以如果你是初学者，不要对此感到不安，只要记住你不应该在生产系统中使用这种方法。

Answer 4

学习SQL的兄弟，它的规则;）

$sql = "INSERT INTO assignments 
      (user_id, project_id, assigned_date) "; 

foreach($assignments as $assigned_user) 
{ 
    $sql.= " VALUES ('" . $assigned_user . "', '" . $project_id . "', '" . time() . "') "; 
} 

我希望你把所有的变量逃脱。