Question

我正在尝试使用postgres在PHP中编写一些预备语句。

解释起来有点困难，所以我只会告诉你：

$stmt = "SELECT * FROM customer WHERE zip = '$1'";

if(isset($_POST["CITY"])){ 
   $stmt .= "AND city = '$2'";
}

if(isset($_POST["COUNTRY"])){ 
   $stmt .= "AND country = '$3'";
}

$result = pg_prepare("myconnection", "my query", $stmt);

$result1 = pg_execute("myconnection","my query", array("0000","someCity","someCountry"));

很抱歉，如果某些代码错误，但这是一个写意的例子。我需要的是能够根据某些变量isset / not-null使预准备语句动态化。当语句只需要1或者我只需要添加$ 1和$ 3而不是$ 2时，在数组中发布3个变量似乎不起作用。我希望你明白。

我需要在本周末使用它，所以我希望有人知道！

提前谢谢！

Answer 1

在准备好的声明中，SQL故意是静态。一旦准备好陈述，参数的数量就不会改变。

但是您的代码很容易根据语句提交正确数量的参数。您可以为参数计数器添加变量，并将动态php数组传递给pg_execute而不是硬编码的文字。并且它们将在if (isset(...))分支内增加/填充。

Answer 2

使用3个不同的语句（每种情况一个）并执行根据传递的参数数量应用的语句没有任何错误。例如：

编辑：我修改了代码以匹配所有情况：

仅指定了zip
Zip + city
Zip + country
Zip + city + country

（即使还有其他一些案例，你也会理解这个想法）

$stmt = "SELECT * FROM customer WHERE zip = '$1'";

if(isset($_POST["CITY"]) && isset($_POST["COUNTRY"])) { 
   $stmt3 = $stmt . " AND city = '$2'" . " AND country = '$3'";
} elseif(isset($_POST["CITY"])) { 
   $stmt1 = $stmt . " AND city = '$2'";
} elseif(isset($_POST["COUNTRY"])) {
   $stmt2 = $stmt . " AND country = '$2'";
}

if(isset($stmt3)) {
   $result = pg_prepare("myconnection", "my query", $stmt3);
   $result1 = pg_execute("myconnection","my query", array("0000","someCity","someCountry"));
} elseif(isset($stmt2)) {
   $result = pg_prepare("myconnection", "my query", $stmt2);
   $result1 = pg_execute("myconnection","my query", array("0000","someCountry"));
} elseif(isset($stmt1)) {
   $result = pg_prepare("myconnection", "my query", $stmt1);
   $result1 = pg_execute("myconnection","my query", array("0000","someCity"));
} else {
   $result = pg_prepare("myconnection", "my query", $stmt);
   $result1 = pg_execute("myconnection","my query", array("0000"));
}

为了简洁，我省略了（正如你所做的）所有错误检查。

Answer 3

虽然Daniel和aymeric都是正确的 - 测试两次，也不使用数字都没有意义。见下文：

$some_vars = array();
$some_vars[":zip"] = $_POST["ZIP"];
$stmt = "SELECT * FROM customer WHERE zip = :zip";

if(isset($_POST["CITY"])){ 
    $some_vars[":city"] = $_POST["CITY"]);
    $stmt .= " AND city = :city";
}

if(isset($_POST["COUNTRY"])){ 
    $some_vars[":country"] = $_POST["COUNTRY"]);
    $stmt .= " AND country = :country";
}

$result = pg_prepare("myconnection", "my query", $stmt);
$result1 = pg_execute("myconnection","my query", $some_vars);

不要忘记消毒等。

Answer 4

不要进行字符串连接。检查参数是否已设置。如果没有将它们设置为空。使用单个查询字符串：

$zip = $_POST["zip"];
$city = $_POST["city"];
$country = $_POST["country"];

if (!isset($zip)) $zip = '';
if (!isset($city)) $city = '';
if (!isset($country)) $country = '';

$stmt = "
    select *
    from customer
    where
        (zip = '$1' or '$1' = '')
        and
        (city = '$2' or '$2' = '')
        and
        (country = '$3' or '$3' = '')
";

$result = pg_prepare("myconnection", "my query", $stmt);
$result1 = pg_execute(
        "myconnection",
        "my query",
        array($zip, $city, $country)
        );

只有当相应的参数不是空字符串时，才会强制执行每个条件。

相同的逻辑可以使用null值而不是空值，这些列包含应该选择的空字符串。

如何在PHP中制作动态postgres预处理语句

4 个答案: