Question

我有以下代码在查询中具有通配符LIKE语句。我的理解是，绑定参数需要在语句之前而不是内部声明为变量。我已经做到了（我认为），但是没有得到结果。没有引发任何错误，但搜索为空。这是原始代码：

$query = $_POST['query'];
$userLoggedIn = $_POST['userLoggedIn'];

$names = explode(" ", $query);

//If query contains an underscore, assume user is searching for usernames
if(strpos($query, '_') !== false) 
    $usersReturnedQuery = mysqli_query($con, "SELECT * FROM users WHERE username LIKE '$query%' AND user_closed='no' LIMIT 4");
//If there are two words, assume they are first and last names respectively
else if(count($names) == 2)
    $usersReturnedQuery = mysqli_query($con, "SELECT * FROM users WHERE (first_name LIKE '$names[0]%' AND last_name LIKE '$names[1]%') AND user_closed='no' LIMIT 4");
//If query has one word only, search first names or last names 
else 
    $usersReturnedQuery = mysqli_query($con, "SELECT * FROM users WHERE (first_name LIKE '$names[0]%' OR last_name LIKE '$names[0]%') AND user_closed='no' LIMIT 4");


if($query != ""){

    while($row = mysqli_fetch_array($usersReturnedQuery)) { etc.etc.

这是我准备的陈述的尝试：

$query = $_POST['query'] . '%';
$userLoggedIn = $_POST['userLoggedIn'];

$names = explode(" ", $query);
$f_name = $names . '[0]%';
$l_name = $names . '[1]%';
$user_closed = 'no';

//If query contains an underscore, assume user is searching for usernames
if(strpos($query, '_') !== false) 
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE username=? AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('ss', $query, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();

//If there are two words, assume they are first and last names respectively
else if(count($names) == 2)
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE (first_name=? AND last_name=?) AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('sss',$f_name, $l_name, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();

//If query has one word only, search first names or last names 
else 
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE (first_name=? OR last_name=?) AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('sss',$f_name, $f_name, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();


if($query != ""){

    while($row = $result->fetch_assoc()) {

谁能看到我哪里出了问题？

Answer 1

解决方案如下：

$query = $_POST['query'] . '%';
$userLoggedIn = $_POST['userLoggedIn'];

$names = explode(" ", $query);
$f_name = $names[0] . '%';
$f_name2 = $names[0] . '%';
$l_name = $names[1] . '%';
$user_closed = 'no';

//If query contains an underscore, assume user is searching for usernames
if(strpos($query, '_') !== false) {
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE username LIKE ? AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('ss', $query, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();


//If there are two words, assume they are first and last names respectively
}else if(count($names) == 2) {
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE (first_name LIKE ? AND last_name LIKE ?) AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('sss',$f_name, $l_name, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();

//If query has one word only, search first names or last names 
}else {
    $usersReturnedQuery = mysqli_prepare($con, "SELECT * FROM users WHERE (first_name LIKE ? OR last_name LIKE ?) AND user_closed=? LIMIT 4");
    $usersReturnedQuery->bind_param('sss',$f_name, $f_name2, $user_closed);
    $usersReturnedQuery->execute();

    $result = $usersReturnedQuery->get_result();
    $usersReturnedQuery->free_result();
}

if($query != ""){

    while($row = $result->fetch_assoc()) { etc...

再次在这里学到了一些东西，希望对其他人也有用。

将包含LIKE的普通SQLi语句转换为准备好的语句

1 个答案: