添加 where 子句时出错

Question

This is likely a beginner error but unfortunately I have not been able to figure it out.

When I run the code below I get the error 'errno' => int 1064 'sqlstate' => string '42000' (length=5) 'error' => string 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\'Caribbean\\'' at line 1' (length=159)

If I use "select * from Country" the query works but when I add "where Region = 'Caribbean'" it does not.

$sql = "select * from Country where Region = 'Caribbean'";
$db = mysqli_init();
$db->options(MYSQLI_OPT_INT_AND_FLOAT_NATIVE, 1);
@ $db->real_connect('localhost', 'user', 'passwd', 'world');
if ($db->connect_errno) {
    echo "Failed to connect to MySQL: (". $db->connection_errno . ")".
      $mysqli->connect_error;
    exit;  
}
$sql = $db->real_escape_string($sql);
$result = $db->query($sql);
var_dump($db->error_list);
var_dump($result->fetch_all());

Answer 1

You can try to check quote symbols, if you copy from a text file which may be different from the symbol in script. Also after entering symbols from keyboard, try to put country name in a variable and call by reference, if still getting error.

Answer 2

You should escape only the params, not the entire query.

something like:

$region = 'Caribbean';
$paramRegion = $db->real_escape_string($region);
$sql = "select * from Country where Region = '".$paramRegion."'";
$db = mysqli_init();
$db->options(MYSQLI_OPT_INT_AND_FLOAT_NATIVE, 1);
@ $db->real_connect('localhost', 'user', 'passwd', 'world');
if ($db->connect_errno) {
    echo "Failed to connect to MySQL: (". $db->connection_errno . ")".
      $mysqli->connect_error;
    exit;  
}
$result = $db->query($sql);
var_dump($db->error_list);
var_dump($result->fetch_all());