Question

我正在使用CodeIgniter的db类来创建查询。

查询最终看起来像这样;

    SELECT `user_id`, `firstname`, `lastname`, `email`, `school_id`, `country_id`
    FROM (`users`)
    WHERE `user_id` != '1'
    AND `firstname` =  'thomas'
    OR `lastname` =  'thomas'
    OR `email` =  'thomas'
    OR `firstname` =  'jefferson'
    OR `lastname` =  'jefferson'
    OR `email` =  'jefferson'

在这种情况下，用户搜索了“thomas jefferson”并且用户自己的id为1.因此，为了确保用户无法搜索自己，它会进行检查，以便user_id不是1.

我知道查询不是那么好，但它完全符合我的需要，而且我太懒了，无法正确地完成它。

这一切背后的PHP代码是

    $this->db->select('user_id, firstname, lastname, email, school_id, country_id')->from('users');
    $this->db->where('user_id !=', $this->session->userdata('user_id'));
    for ($i = 0; $i < count($searchQuery); $i++) {
        if ($i == 0) {
            $this->db->where('firstname', $searchQuery[$i])->or_where('lastname', $searchQuery[$i])->or_where('email', $searchQuery[$i]);
        } else {
            $this->db->or_where('firstname', $searchQuery[$i])->or_where('lastname', $searchQuery[$i])->or_where('email', $searchQuery[$i]);
        }
    }
    $this->db->limit(10);
    $query = $this->db->get();

我99％肯定

    WHERE `user_id` != '1'
    AND(<-- this) `firstname` = ...

错了，但似乎无法找到另一种方法。

Answer 1

在sql server中查看Operation Precedence 在那里，您会发现在AND操作之前评估OR个操作。

这意味着您的查询首先评估AND：

user_id != '1' AND firstname = 'thomas'

然后

OR blablablablabla (the rest of the query)

为了使其正确，它将是这样的：

   SELECT `user_id`, `firstname`, `lastname`, `email`, `school_id`, `country_id`
    FROM (`users`)
    WHERE `user_id` != '1'
    AND (`firstname` =  'thomas'
    OR `lastname` =  'thomas'
    OR `email` =  'thomas'
    OR `firstname` =  'jefferson'
    OR `lastname` =  'jefferson'
    OR `email` =  'jefferson')

Answer 2

你必须以这种形式组织括号...... 选择user_id，firstname，lastname，email，school_id，country_id FROM（users）在哪里user_id！='1' AND（firstname ='托马斯' 或lastname ='托马斯' 或email ='托马斯' 或firstname ='杰斐逊' 或lastname ='杰斐逊' 或email ='杰斐逊'）

Answer 3

尝试就好了

SELECT `user_id`, `firstname`, `lastname`, `email`, `school_id`, `country_id`
FROM (`users`)
WHERE `user_id` != 1 
AND 
( `firstname` =  'thomas'
OR `lastname` =  'thomas'
OR `email` =  'thomas'
OR `firstname` =  'jefferson'
OR `lastname` =  'jefferson'
OR `email` =  'jefferson' )

Answer 4

感谢您的回答！我通过这样做来修复它;

    $sql = "SELECT user_id, firstname, lastname, email, school_id, country_id FROM users WHERE user_id != " . $this->session->userdata('user_id');
    $firstname = array();
    $lastname = array();
    $email = array();

    foreach ( $searchQuery as $a )
    {
        if ( ! empty($a) )
        {
            $firstname[] = "'".$a."'";
            $lastname[] = "'".$a."'";
            $email[] = "'".$a."'";
        }
    }
    $firstname = implode(',', $firstname);
    $lastname = implode(',', $lastname);
    $email = implode(',', $email);

    $sql .= " AND(firstname IN($firstname) OR lastname IN($lastname) OR email IN($email))";

    $query = $this->db->query($sql);

编辑：刚注意到我没有真正清除注射的字符串

MySQL语句中的多个WHERE给了我麻烦

4 个答案: