显示动态结果PHP mySQL

我有一个问题，用sql作为值而不是名称本身提取列名称。显示动态结果PHP mySQL

因此，例如，返回结果显示

SELECT ll_project.project_id, ll_project.size, ll_lessons.lesson_title FROM ll_project INNER JOIN ll_lessons ON ll_project.project_id = ll_lessons.project_id WHERE ll_project.project_id = BSKYB5555 
Unknown column 'BSKYB5555' in 'where clause'

从下面的代码

$pid = $_POST['project_id'] ; 
$psize = $_POST['projectSize'] ; 
$pdepts = $_POST['depts'] ; 
$lstage = $_POST['stage'] ; 
$ltype = $_POST['type'] ; 
$impacted = $_POST['impacted'] ; 
//Your columns in the DB 
$columns = array('project_id'=>'ll_project.project_id','projectSize'=>'ll_project.size','depts'=>'ll_project.deptartment','stage'=>'ll_lessons.stage','type'=>'ll_lessons.type','impacted'=>'impacted'); 

$sqlString = null; 
echo "Total Number Of Captured Post Variables is:"; 
echo count($_POST); 
echo '<br />'; 

$number = 0; 
$queryStr = ""; 
$preStr = array(); 
foreach ($_POST as $key => $val) { 

if (!empty($_POST[$key])){ 
     if(!is_array($_POST[$key])) 
      $currentStr = $columns[$key]." = ".$val; 
     else 
     $currentStr = $columns[$key]." IN (".implode(',',$_POST[$key]).")"; 
     $preStr[] = $currentStr; 
    } 
} 
$queryStr = "SELECT ll_project.project_id, ll_project.size, ll_lessons.lesson_title FROM ll_project INNER JOIN ll_lessons ON ll_project.project_id = ll_lessons.project_id WHERE ".implode(' AND ',$preStr); 

echo $queryStr; 
echo '<br />'; 
if($number ==1) { 
}else{ 
} 

$result = mysql_query($queryStr) or die(mysql_error()); 
while($row = mysql_fetch_assoc($result)) { 
echo ' <tr> 
<td>'.$row['project_name'].' </td> 
<td>'.$row['project_id']. ''; 
}

我在做什么错了，这是为什么拿起值作为列名？

来源

2013-05-15 Tazzy

添加在你的查询值引号

SELECT ll_project.project_id, ll_project.size, ll_lessons.lesson_title FROM ll_project INNER JOIN ll_lessons ON ll_project.project_id = ll_lessons.project_id WHERE ll_project.project_id = "BSKYB5555"

由于没有报价，它不会把它作为一个字符串

编辑

不幸的是，代码和逻辑是有点难以请按照因为没有评论

您可以尝试替换

$currentStr = $columns[$key]." = ".$val;

与

$currentStr = $columns[$key]." = '".mysql_real_escape_string($val)."'";

这应该解决您的问题，并删除SQL注入漏洞，你现在有直接在查询中使用用户输入。

来源

2013-05-15 08:15:52 Anigel

你能告诉我一个例子？不确定报价应该在哪里？好吧，我看到她生病尝试 – Tazzy

SELECT是从动态查询生成的$ columns = array（'project_id'=>'ll_project.project_id'，etc ... 是否需要双引号' project_id'？ – Tazzy

我最初并没有写信给查询，它是从$ columns = array keys和values中的动态查询中抓取的。我没有办法将双引号放在“Number”的周围，如图所示当从$ queryStr回声; – Tazzy

如果您在查询中使用字符串，你必须enclapse它

SELECT ll_project.project_id, ll_project.size, ll_lessons.lesson_title FROM ll_project INNER JOIN ll_lessons ON ll_project.project_id = ll_lessons.project_id WHERE ll_project.project_id = 'BSKYB5555'

来源

2013-05-15 08:16:41

显示动态结果PHP mySQL

回答

相关问题