SQL查询中的PHP整数值

Question

这里$id是整数值，不会从MySQL中删除：

$Query="DELETE FROM table WHERE id='.$id.' and cid='".$cid."'";

Answer 1

Your problem in short: you have mixed different quotation marks - " and ' .

This problem would not arise if you would use prepared statements , as you would have had a single string literal:

$Query="DELETE FROM table WHERE id=? and cid=?";

This would also remove the possibility of SQL injections .

This would also speed-up you program if you need to execute the same prepared statement several times (the statement is already prepared and does not need to be parsed on the second+ invocation).

And finally, in case you are still using the officially deprecated PHP mysql extension you MUST switch to mysqli and use its full benefits like prepared statements. The mysql extension is no longer officially supported and may be removed in future (though I foresee that it will be moved to PEAR or so).

---

As a temporary solution, use mysql_real_escape_string to encode all variables which are derived from the user input. Please do NOT use mysql_escape_string as it is highly vulnerable to character encoding!

Answer 2

You forgot to close your "

The Solution:

$id = mysql_real_scape_string($id);
$cid = mysql_real_scape_string($cid);

$Query="DELETE FROM table WHERE id='".$id."' and cid='".$cid."'";

The Problem

So, if you were to echo out your statement as it was, the result would look like:

DELETE FROM table WHERE id='.1.' and cid='2'

See the problem with that?