Question

我尝试将$username添加到MySQL查询中，如下所示。但是查询因SQL语法错误而失败。

$username = $this->input->post('username');
$sql = "SELECT * FROM temp_user UNION SELECT * FROM member WHERE username = ".$username."";
$query = $this->db->query($sql);

此查询有什么问题？

以下是错误消息错误号码：1064

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1

SELECT * FROM temp_user UNION SELECT * FROM member WHERE username =

Filename: C:/xampp/htdocs/dex/system/database/DB_driver.php

Line Number: 691

Answer 1

尝试这样，不需要字符串连接

$sql = "SELECT * FROM temp_user UNION SELECT * FROM member WHERE username = '$username'";

Answer 2

SQL语法错误可能是由于这一部分：

db.table.find("text", {search:"\"small\" \"cell\" \"lung\""})

您应该escape "... WHERE username = ".$username."";

那是

$username

其中"... WHERE username = ".$this->db->escape($username);是表示链接标识符的$conn对象。

Answer 3

解决!!!因为我不能使用星号（*）和联盟

$ sql =＆＃34; SELECT username FROM temp_user WHERE username =＆＃39;＆＃34;。$ username。＆＃34;＆＃39; UNION SELECT用户名FROM成员WHERE用户名=＆＃39;＆＃34;。$ username。＆＃34;＆＃39;＆＃34;;

PHP Codeigniter：SQL语法错误`WHERE username = $ username`

3 个答案: