Question

我的php代码有问题。我需要在php页面的WHERE会话名称中查询db。代码如下：

viewsArray[i].children
    .flatMap { $0 as? SKSpriteNode }
    .filter { $0.color == .blackColor() && $0.alpha == 1 }
    .forEach { $0.alpha = 0.5 }

当我使用标准方式（“。$ variable。”）传递php变量时，我得到以下错误：

致命错误：在布尔值中调用成员函数fetch（）第35行的路径/至/我/页

如果有人想帮助我解决我的问题，我会很高兴感谢他

Answer 1

尝试

        <?php session_start();
            try { 
              //$con= new PDO('mysql:host=localhost;dbname=wydania_tonery', "sa", "sql");
              $zmien_kodowanie = $dbo->query("SET names 'utf8'");
              $sesja = $_SESSION['username'];
              $query = "SELECT
                            mdl_user.firstname AS 'Imie',
                            mdl_user.lastname AS 'Nazwisko',
                            mdl_user.department AS 'Akronim',
                            reg.data AS 'Region',
                            sta.data AS 'Stanowisko',
                            mdl_user.aim AS 'Stan',
                            NULLIF('Uwagi', 0) AS 'Uwagi'
                        FROM
                            mdl_user 
                        LEFT JOIN 
                            mdl_user_info_data AS reg ON reg.userid=mdl_user.id AND reg.fieldid='2' 
                        LEFT JOIN 
                            mdl_user_info_data AS sta ON sta.userid=mdl_user.id AND sta.fieldid='4' 
                        WHERE 
                            mdl_user.email LIKE 'kierownik.%' AND mdl_user.deleted='0' AND mdl_user_info_data.fieldid = ? /*AND mdl_user.department='BBT'*/ 
                        ORDER BY 
                            mdl_user.department ASC";

              //first pass just gets the column name
              echo "<table> \n";
              $stmt = $dbo->prepare($query);
              $stmt->bind_param("s", $_SESSION['username']);                  
              $result = $stmt->execute();

Answer 2

您可以使用以下方法来避免使用直接替换值，而不是使用直接替换值。

你基本上有两个选择来实现这个目标：

使用PDO：

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array('name' => $name));

foreach ($stmt as $row) {
    // do something with $row
}

请参阅How can I prevent SQL-injection in PHP?

在MySQL语句中使用会话名称

2 个答案: