在PHP中从Table获取主题

Question

OK So I'm trying to access a table called emg_quote I have the Quote ID so Im trying to get the Column Subject from the same row as this ID but for some reason All I'm getting is the first row in the entire table? Can any one figure out what I'm doing wrong? Here is my coding:

$row['quote_id'] = quoteTitle($row['quote_id']);

function quoteTitle($quoteid){
    global $db;

    $sql = "SELECT subject FROM emg_quote WHERE ".$quoteid."";
    $res = $db->query($sql);
    $row = $db->fetch_row();

    $output = $row['subject'];

    return $output;
}

Answer 1

Are you using a custom object to wrap the native API's?

Either way it doesn't look right to me. You don't seem to be using the result of the query.

ie

$result = $mysqli->query($query);
$row = $result->fetch_row();

Answer 2

You have few bad practices in your code.

A. You lie on $quoteid to give you the correct where syntax. ie: ID=123 This is an highly unsafe method, because the user can change the it to Some-Important-Details='bla' To extract more details from this table or others.

B. You should ALWAYS escape characters when receiving data from user, otherwise you easily subjected to SQL-Injections. And believe me you don't want it.

Answer 3

you have to use the checking after where. use you column name before your $quoteid variable

$row['quote_id'] = quoteTitle($row['quote_id']);

function quoteTitle($quoteid){
global $db;

$sql = "SELECT subject FROM emg_quote WHERE quoteid=".$quoteid." LIMIT 1 ";
$res = $db->query($sql);
$row = $db->fetch_row();

$output = $row['subject'];

return $output;
}

Remember : USE limit 1 when you search with primary key and you know that only 1 record will be searched. it reduce your processing time.

Answer 4

You might be missing the where column.

$sql = "SELECT subject FROM emg_quote WHERE quote_id=".$quoteid."";
                                            ^^^^^^^^

We also do not see weather something with your Db class is wrong.

You should in any case not directly put request variables into a database query.

Answer 5

$sql = "SELECT subject FROM emg_quote WHERE ID='".$quoteid."'";

您没有在where条件中写入数据库字段名