WHERE子句语法

Question

怎么了我的sysntax，我不明白。有没有更好的办法？

<? 
      $uid = $_GET["uid"]; 
      $month= $_GET["month"]; 
      $year = $_GET["year"]; 
      $query = "SELECT taskname,uid,month,year, SUM(tasktime) FROM tictoc WHERE uid = $uid, month = $month, year = $year GROUP BY taskname"; 

      $result = mysql_query($query) or die(mysql_error()); 

      // Print out result 
      while($row = mysql_fetch_array($result)){ 
       echo "<br />"; 
       echo "Total ". $row['taskname']. " = <strong>". $row['SUM(tasktime)']."</strong>"; 
       echo "<br />"; 
      } 
      ?> 

错误是：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' month = 'Aug', year = '2012' GROUP BY taskname' at line 1 

Answer 1

您需要使用AND，而不是一个逗号，像这样：

select taskname, uid, month, year, SUM(tasktime) 
from tictoc 
where uid = $uid 
    and month = $month 
    and year = $year 
group by taskname 

另外，还要注意行：

echo "Total ". $row['taskname']. " = <strong>". $row['SUM(tasktime)']."</strong>"; 

不管用。您需要别名查询和参考的总和该别名，就像这样：

SELECT taskname,uid,month,year, SUM(tasktime) as SumTaskTime 

然后执行：

echo "Total ". $row['taskname']. " = <strong>". $row['SumTaskTime)']."</strong>"; 

Answer 2

为了补充以前的答案，检查参数没有到达空。例如：

$uid = $_GET["uid"] = $_GET["uid"] == "" ? 0 : $_GET["uid"]; 
$month = $_GET["month"] = $_GET["month"] == "" ? 0 : $_GET["month"]; 
$year = $_GET["year"] = $_GET["year"] == "" ? 0 : $_GET["year"]; 

或选择您的检查策略。

原因是，如果他们到达空，而您没有验证它，您将错误地构建您的SQL语句，并且您将有您报告的错误。