Postgresql SELECT没有硬编码项

时间:2018-01-16 07:15:11

标签: sql postgresql prepared-statement postgresql-9.1 angularjs-1.5

我有一个简单的PostgreSql查询,如下所示:

$params = array();

if ($audienceId === x) {
  // all teachers
  $pullRecipients = $db -> prepare(
    "SELECT email FROM app.employees WHERE emp_cat_id = 1 AND active is true");
}

$pullRecipients -> execute($params);

我正在根据下拉选项运行查询,因此,例如,如果用户选择TEACHERS,则运行上述查询。如何在不在查询中对其进行硬编码的情况下选择emp_cat_id甚至类别名称TEACHERS

1 个答案:

答案 0 :(得分:0)

将陈述改为

SELECT email
FROM app.employees
WHERE emp_cat_id = ? AND active IS true

并确保您的$params等同于array($POST["drop-down_value])

如果你想允许文本值 - 请使用join,例如:

SELECT email
FROM app.employees
WHERE emp_cat_id = (SELECT id FROM emp_cat WHERE name = ?)
  AND active IS true