如何使用字母数字值检索数据？

Question

Is it possible to retrieve data using a value that is alphanumeric?

Because whenever my "product_id" value is alphanumeric it doesn't work but it only works when the value is numerical.

Eg it only works when the "product_id" = 1 , but when "product_id" = 1a it does not work.

// get a product from products table
$result = mysql_query("SELECT * FROM tbl_product WHERE product_id = $product_id");

if (!empty($result)) {
    // check for empty result
    if (mysql_num_rows($result) > 0) {

        $result = mysql_fetch_array($result);

        $product = array();
        $product["product_id"] = $result["product_id"];
        $product["product_des"] = $result["product_des"];
        $product["price"] = $result["price"];
        $product["qty"] = $result["qty"];
        $product["product_cat"] = $result["product_cat"];
        $product["product_sect"] = $result["product_sect"];
        // success
        $response["success"] = 1;

        // user node
        $response["product"] = array();

        array_push($response["product"], $product);

Answer 1

You need to use quotes; or preferably prepared statements. SQL strings need to be quoted.

Eg

Select * from users where name = chris

is invalid SQL. But

Select * from users where name = 'chris'

would be valid.

So

$result = mysql_query("SELECT * FROM tbl_product WHERE product_id = $product_id");

Should be

$result = mysql_query("SELECT * FROM tbl_product WHERE product_id = '$product_id'");

since you are using mysql_ functions be sure that $product_id is being passed through mysql_real_escape_string . Note the warnings on all the mysql_ function pages as well and consider updating your driver.

With mysqli and pdo you can use prepared statements, which if used correctly handle the quoting for you.

A prepared example would be

$result = $pdo->prepare("SELECT * FROM tbl_product WHERE product_id = ?");
$result->execute(array($product_id));

For additional reading:

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#Defense_Option_1:_Prepared_Statements_.28Parameterized_Queries.29