带引号的SQL查询不会返回结果

Question

I'm trying to query my sql database using PDO. There are instances in which there are quotes in my query.

function getPageByPagid($pagid) {
    $db = dbConnection();

    $sql = "SELECT * FROM pages WHERE pagid='".$pagid."'";
    $q = $db->prepare($sql);
    $q->setFetchMode(PDO::FETCH_ASSOC);
    $q->execute();
    $results = $q->fetch();

    return $results;
}

The function I'm using does prepare my SQL so that it still should work if $pagid has quotes in it. Now it is working when there aren't quotes, but it still isn't when there are quotes. Why isn't this working?

PS: The quotes aren't escaped or anything in my database.

Answer 1

May be causing you have integer type of field and sending string try with

$sql = "SELECT * FROM pages WHERE pagid='$pagid'";

or better to use placeholder (PDO standard)

function getPageByPagid($pagid) {
    $db = dbConnection();
    $sql = "SELECT * FROM pages WHERE pagid= :pagid";
    $q = $db->prepare($sql);
    $q->bindParam(':pagid', $pagid);
    $q->setFetchMode(PDO::FETCH_ASSOC);
    $q->execute();
    $results = $q->fetch();
    return $results;
}