PHP SQLSRV - 参数化时全文查询不起作用

Question

当我通过PHP sqlsrv驱动程序运行以下查询时，没有发生任何错误，但没有行被返回...如果我摆脱了问号（应该是参数），并键入关键词，然后返回行就好了......

SELECT DISTINCT 
    MAX(i.ID) AS ID, 
    i.ItemLookupCode, 
    MAX(i.DepartmentID) AS DepartmentID, 
    MAX(i.CategoryID) AS CategoryID, 
    MAX(i.Quantity) AS Quantity, 
    MAX(CAST(i.Notes AS varchar(max))) AS Notes, 
    MAX(CONVERT(varchar(30), i.Price, 1)) AS Price, 
    MAX(i.SaleType) AS SaleType, 
    MAX(i.SaleStartDate) AS SaleStartDate, 
    MAX(i.SaleEndDate) AS SaleEndDate, 
    MAX(CONVERT(varchar(30), i.SalePrice, 1)) AS SalePrice, 
    MAX(i.PictureName) AS PictureName, 
    MAX(n.SpoofStock) AS SpoofStock, 
    MAX(n.PAM_Brand) AS Brand 

FROM Item AS i 

LEFT JOIN nitroasl_pamtable AS n 
    ON i.ID = n.ItemID 

WHERE CONTAINS(
    (i.ItemLookupCode, i.Notes, i.Description, i.ExtendedDescription), 
    '? AND ?') 

OR CONTAINS(
    (n.PAM_Brand, n.ManufacturerPartNumber, n.PAM_Keywords), 
    '? AND ?') 

AND (i.WebItem = 1 AND i.Price > 0) 

GROUP BY i.ItemLookupCode 

ORDER BY i.ItemLookupCode ASC 

我核实，我的参数数组是正确的......下面是我的脚本：

require LIBRARY_PATH . "/connect-db.php"; 

$tsql = "SELECT DISTINCT 
      MAX(i.ID) AS ID, 
      i.ItemLookupCode, 
      MAX(i.DepartmentID) AS DepartmentID, 
      MAX(i.CategoryID) AS CategoryID, 
      MAX(i.Quantity) AS Quantity, 
      MAX(CAST(i.Notes AS varchar(max))) AS Notes, 
      MAX(CONVERT(varchar(30), i.Price, 1)) AS Price, 
      MAX(i.SaleType) AS SaleType, 
      MAX(i.SaleStartDate) AS SaleStartDate, 
      MAX(i.SaleEndDate) AS SaleEndDate, 
      MAX(CONVERT(varchar(30), i.SalePrice, 1)) AS SalePrice, 
      MAX(i.PictureName) AS PictureName, 
      MAX(n.SpoofStock) AS SpoofStock, 
      MAX(n.PAM_Brand) AS Brand 

     FROM Item AS i 

     LEFT JOIN nitroasl_pamtable AS n 
      ON i.ID = n.ItemID 

     WHERE CONTAINS(
      (i.ItemLookupCode, i.Notes, i.Description, i.ExtendedDescription), 
      '? AND ?') 

     OR CONTAINS(
      (n.PAM_Brand, n.ManufacturerPartNumber, n.PAM_Keywords), 
      '? AND ?') 

     AND (i.WebItem = 1 AND i.Price > 0) 

     GROUP BY i.ItemLookupCode 

     ORDER BY i.ItemLookupCode ASC"; 

// Allows us to determine the number of rows returned 
$cursorType = array('Scrollable' => SQLSRV_CURSOR_KEYSET); 

$stmt = sqlsrv_query($conn, $tsql, $params, $cursorType); 

if (!$stmt) 
{ 
    die(FormatErrors(sqlsrv_errors())); 
} 

if(sqlsrv_has_rows($stmt)) 
{ 
    while($row = sqlsrv_fetch_array($stmt, SQLSRV_FETCH_ASSOC)) 
    { 
    $results[] = $row; 
    } 
} 

sqlsrv_free_stmt($stmt); 

require LIBRARY_PATH . "/disconnect-db.php"; 

的参数数组对于上面的脚本看起来像这样：

Array 
(
    [0] => displayport 
    [1] => hdmi 
    [2] => displayport 
    [3] => hdmi 
) 

请注意，我会动态创建字符串，根据解析关键字的数量来填充"?" AND "?"。我证实这些字符串是正确的，上面反映了它们会产生什么。

SO，这是不是一个有效的参数化sqlsrv查询？

Answer 1

CONTAINS子句的第二个参数是您应该参数化的内容。

这一部分：

WHERE CONTAINS(
    (i.ItemLookupCode, i.Notes, i.Description, i.ExtendedDescription), 
    '"?" AND "?"') 

OR CONTAINS(
    (n.PAM_Brand, n.ManufacturerPartNumber, n.PAM_Keywords), 
    '"?" AND "?"') 

应该这样写：

WHERE CONTAINS(
    (i.ItemLookupCode, i.Notes, i.Description, i.ExtendedDescription), 
    ?) 

OR CONTAINS(
    (n.PAM_Brand, n.ManufacturerPartNumber, n.PAM_Keywords), 
    ?) 

，并假设你$params是这样的：

$params = ['a', 'b', 'c', 'd'] 

应该再像：

$params = [ 
    '"a" AND "b"', 
    '"c" AND "d"' 
]