如何在PHP中使用存储在数据库中的SQL查询中的变量

Question

I stored my SQL query in database and at this query i used PHP variable; then when i fetch the data from MySQL the variable which used in query does not work and query die! what should i do?

Exp: I stored this query on database:

"SELECT * FROM mytable WHERE id='$id' OR name='$name'"

and then when fetch this query the variables does not work in code like this:

mysqli_query($conn,$sql)

or

mysqli_query($conn,"$sql")

Answer 1

在 php 中使用 (.) continate运算符和更多详细信息请参阅

"SELECT * FROM mytable WHERE id='".$id."' OR name = '".$name."'"

Answer 2

mysqli_query - Performs a query on the database 
mysqli_fetch_array - Fetch a result row as a numeric array and as an associative array

try following code to fetch data

$sql= mysqli_query($coni, "SELECT * FROM mytable WHERE id='$id' OR name='$name'");
$info = mysqli_fetch_array($sql)

Answer 3

You have to use mysqli_fetch_array() after executing mysqli_query() . The following code will print all rows matching your query.

$result = mysqli_query($conn, $sql);
while($row=mysqli_fetch_array($result)){
    print_r($row);
}

If that does not work. Be sure that you have the correct link to the database

$conn= mysqli_connect("127.0.0.1", "my_user", "my_password", "my_db");

More info about mysqli_connect can be seen in the documentation .

But it is more safe to use the PDO(PHP Database Object), beacuse it gives a better layer of security with prepared statements .

There is a tutorial about PDOs . Look at it for more details. For even more details refer the PDO documentaion .

Answer 4

One of the problems of storing a statement as you have in the database is that it assumes that there are variables called $id and $name in scope at the time you execute the statement. If instead you used prepared statements and place holders, you can bind the values you need at the time you run the statement.

So your statement would be...

"SELECT * FROM mytable WHERE id=? OR name=?"

You would then run it using

$stmt = mysqli_prepare($conn,$sql);
mysqli_stmt_bind_param($stmt, "ss", $id1, $searchNname);
mysqli_stmt_execute($stmt);
// Process data as you need to

(Still not convinced that holding these statements in the database is a good idea, but that is up to you.)