与名称中包含撇号的名称匹配

Question

I have a query in which I want to match fname and lname

$result = $mysqli->query('SELECT * FROM user WHERE userId = "'.$_SESSION["userId"].'" AND FriendFirstName = "'.htmlentities($firstName, ENT_QUOTES,"UTF-8").'" AND FriendLastName = "'.htmlentities($lastName, ENT_QUOTES,"UTF-8").'"   AND   FriendStatusCode="verified" AND friendId!='.$fid.' AND ViewableRow <> "0" ')  or die($mysqli->error);
echo 'SELECT * FROM user WHERE userId = "'.$_SESSION["userId"].'" AND FriendFirstName = "'.htmlentities($firstName, ENT_QUOTES,"UTF-8").'" AND FriendLastName = "'.htmlentities($lastName, ENT_QUOTES,"UTF-8").'"   AND   FriendStatusCode="verified" AND friendId!='.$fid.' AND ViewableRow <> "0" ';

If I have a name John'y then it doesn't produce any result, it returns no rows, I echoed the query and If I run the same query I get result in my sql.

The output becomes like this

SELECT * 
FROM user_friend_detail
WHERE userId = "9306" AND FriendFirstName = "Aa\'tid"
AND FriendLastName = "Kenddy" 
AND FriendStatusCode="verified" AND friendId!=9366 AND ViewableRow  "0"

and it returns row in mysql. I have magic quotes turned off, I assumed it to be a very simple problem but it wasted so much of my time.

The FNAME is Aa'tid
The lname is Kenddy

am I missing something?

Answer 1

Since we've discussed changing to prepared statements in the comments, here's what you can do (this is the object-oriented approach, separate from the older, procedural approach):

// this code will use the following variables that you must set somewhere before running your query:
//     $firstName
//     $lastName
//     $fid
// it also uses:
//     $_SESSION["userId"]

// connect to the database (fill in values for your database below)
$mysqli = new mysqli('host','username','password','default database');

// build query with parameters
$query = "SELECT * FROM user WHERE userId = ? AND FriendFirstName = ? AND FriendLastName = ? AND FriendStatusCode='verified' AND friendId != ? AND ViewableRow <> '0'";

// prepare statement
if ($stmt = $mysqli->prepare($query)) {

    // bind parameters
    $stmt->bind_param("issi", $_SESSION['userId'], $firstName, $lastName, $fid);

    // execute statement
    $stmt->execute();

    // set the variables to use to store the values of the results for each row (I made the variables up, in this case, let's assume your query returns 3 columns, `userId`, `firstName`, and `lastName`)
    $stmt->bind_result($returnUserId, $returnFirstName, $returnLastName);

    // loop through each row
    while ($stmt->fetch()) {

        // output the variables being looped through
        printf ("%d: %s %s\n", $returnUserId, $returnFirstName, $returnLastName);

    }

    // close statement
    $stmt->close();

}

// close connection
$mysqli->close();

This example doesn't use error handling, but it should. There are also plenty of other ways to work with result sets (eg associative arrays), which you can look at the docs to use. In this example, I used bind_result to loop through rows and actually assign variables because I believe it to be cleaner and easier to keep track of when you have a lot of code.