如何為select語句編寫sql查詢

Question

$dep=$_SESSION['dep'];
$type="DON’T DO’S";
$res=  mysql_query("select * from treatment where treatment_dep='$dep' and treatment_type='$type'");
while($res1=  mysql_fetch_array($res)){ 
    echo $res1['treatment_treatment'];
}

僅當我從查詢中刪除“ and treatment_type ='$ type'”時，此查詢才有效。 這是因為$ type包含單引號。

如何編寫查詢來解決此類問題。

Answer 1

這將幫助您檢查錯誤。

   // Perform Query
    $result = mysql_query($query);

    // Check result
    // This shows the actual query sent to MySQL, and the error. Useful for debugging.
    if (!$result) {
        $message  = 'Invalid query: ' . mysql_error() . "\n";
        $message .= 'Whole query: ' . $query;
        die($message);
    }

Answer 2

$dep=$_SESSION['dep'];
$type="DON’T DO’S";

//Sanitize it for SQL as follows
$type = str_replace("'", "''", trim($type));
//Sanitization Complete

$res=  mysql_query("select * from treatment where treatment_dep='$dep' and treatment_type='$type'");
while($res1=  mysql_fetch_array($res)){ 
    echo $res1['treatment_treatment'];
}

Answer 3

嘗試將變量中的引號字符更改為\\'，如下所示：

$type = "DON\'T DO\'S";

如果您需要對動態數據執行此操作，則可以使用

$type = strtr($type, "'", "\'");