基本PHP-SQL查询中的条件串联

Question

I'm having some trouble with what I believe should be some fairly simple PHP. It's run inside of WordPress, but the question shouldn't be WordPress specific. The $wpdb->get_results() is just a way to query the WordPress database without having to use a connection string. I also use a couple of $_GET commands.

Here's what I have so far:

$Data = $wpdb->get_results("SELECT *
    FROM database.table
    WHERE sem.MonthNum >= " .$_GET["minMonth"]. "
    AND sem.MonthNum <= " .$_GET["maxMonth"]. "
    AND sem.Year  >= " .$_GET["minYear"]. "
    AND sem.Year <= " .$_GET["maxYear"]. ");

This works, so long as the $_GET is populated. I'd like to add a kind of default value such that if $_GET is empty, a number is set, and if it's not empty, it grabs that number. Something along the lines of...

$Data = $wpdb->get_results("SELECT *
    FROM database.table
    WHERE sem.MonthNum >= " if(!$_GET){echo 1;} else {echo ".$_GET[\"minMonth\"]. "} "

But that doesn't work for me...probably some silly PHP syntax error, I'm not sure about all the echo statements and the quotes within other quotes and whatnot.

Answer 1

For each of your variables do this:

$minMonth = isset($_GET["minMonth"]) ? intval($_GET["minMonth"]) : 1;
... 
"WHERE sem.MonthNum >= " .minMonth. "

The intavl() call will make convert the $_GET value to an integer if it is not already, which will protect you from SQL injection security issues. If you need to do something similar with strings, use something like mysql_escape_string() instead.

Answer 2

You could add a variable for each, for example:

// If not set $minMonth is set to 1
$minMonth = (isset($_GET['minMonth']) ? $_GET['minMonth'] : 1);

Just do this for the other variables as well.

Answer 3

You can use short hand notation like Scott and David show directly in your query:

$Data = $wpdb->get_results("SELECT *
FROM database.table
WHERE sem.MonthNum >= ".(!isset($_GET['minMonth'])?'1':$_GET['minMonth'])."
AND...

You really need to sanitize the variables first though, otherwise you could be SQL injected very easily.