如何编写使用PHP变量的MySQL查询？

Question

How to place a php variable into query?

$shopid = $pdo->query('SELECT shopid FROM `shop` WHERE shopname='$shopname'')->fetchAll(PDO::FETCH_ASSOC);

This is not working, the error message show: "Parse error: syntax error, unexpected '$shopname' (T_VARIABLE)"

Answer 1

No

Do not insert parameters this way. You should be using bindParam

$statement = $db->prepare('SELECT shopid FROM shop WHERE shopname=:shopname');
$statement->bindParam(':shopname', $shopname, PDO::PARAM_STR);
$statement->execute();

Answer 2

If $shopname is coming from an untrusted source, you are wide open to SQL injection. To fix this, you should make use of PDO and it's prepared statement API:

$query = $pdo->prepare("SELECT shopid FROM shop WHERE shopname = ?");
$query->bindValue(1, $shopname, PDO::PARAM_STR);
$query->execute();

$shopid = $query->fetchAll(PDO::FETCH_ASSOC);

Answer 3

您没有正确包装查询。

$shopid = $pdo->query("SELECT shopid FROM `shop` WHERE `shopname`='$shopname'");

Answer 4

if you support the PDO ,why not use the prepare, and it is more safe.

$stmt = $pdo->prepare('SELECT shopid FROM shop WHERE shopname=:shopname');
$stmt->bindParam(':shopname', $shopname);
$shopname = $yourdefined;
$stmt->execute();

$stmt->bindColumn(1, $shopid);
    while($stmt->fetch()){
      echo $shopid,PHP_EOL;

    }

Well,you can also use the base sql like this:

$shopid = $pdo->query('SELECT shopid FROM `shop` WHERE shopname=\'{$shopname}\'')->fetchAll(PDO::FETCH_ASSOC);

Answer 5

'...' . $shopname . '...'

Using point to join more than 1 string

Answer 6

Try This:

$query = "SELECT shopid FROM shop WHERE shopname= '".$shopname."'";

$result = mysql_query($query);