通过PHP变量选择MySQL查询

Question

我在$booked_num中得到零，我尝试了用SQL中的值代替变量的查询，它工作得很好。但是我不知道哪里出错了，请帮帮我。我已经回显了每个变量，一切都很好，但是$booked_row中没有任何内容，$booked_num中回显零。

require_once 'mysql_connector.php';
$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;
$booked_num = mysql_num_rows($booked_result);
echo $booked_num;
$booked_row = mysql_fetch_array($booked_result,MYSQL_ASSOC);
print_r($booked_row);

Answer 1

$booked_result = mysql_query('select * from booked where train_no = ".$train_no." and date = ".$date." and st_from = ".$st_from." and st_to = ".$st_to.";') or die(mysql_error()) ;

此语法不正确-您需要在连接变量之前关闭字符串。比如:

$booked_result = mysql_query('select * from booked where train_no = "' .$train_no. '" and date = "' .$date. '" and st_from = "' .$st_from. '" and st_to = "' .$st_to. '";') or die(mysql_error());

另外，您应该考虑切换到PDO库。除此之外，它将帮助您避免查询中的sql注入攻击。