Question

我有这样的代码：

function search_keyword(){
            $keyword = trim($_POST['keyword']);
            $search_explode = explode(" ", $keyword);
            $x = 0;

            $sql = " ( SELECT  name, id_global_info AS id, body AS body, tag AS tag  ,info_type_id AS info_type, \"global_info\" AS mytable FROM global_info WHERE ";
            foreach($search_explode as $each){
                $x++;
                if($x == 1){
                   $sql .= " name LIKE '%$each%' ";}                          
                else {

                    $sql .= " AND name LIKE '%$each%' ";
                }
            }

              $sql .= " ) UNION ALL "; 

              $sql .= " ( SELECT name, id_person AS id, surname AS body, info AS tag , location AS info_type, \"person\" AS mytable FROM person WHERE ";
            foreach($search_explode as $each){
                $x++;
                if($x == 1){
                   $sql .= " name LIKE '%$each%' ";}                          
                else {

                    $sql .= " AND name LIKE '%$each%' ";
                }
            }

              $sql .= " ) UNION ALL ";

              $sql .= "( SELECT name, id_event AS id, body AS body, caffe_id AS tag , date AS info_type, \"event\" AS mytable FROM event WHERE ";
            foreach($search_explode as $each){
                $x++;
                if($x == 1){
                   $sql .= " name LIKE '%$each%' ";}                          
                else {

                    $sql .= " AND name LIKE '%$each%' ";
                }
            }

            $sql .= " ) UNION ALL ";

              $sql .= "( SELECT name, id_caffe AS id, description AS body, adress AS tag, location_id AS info_type, \"caffe\" AS mytable FROM caffe WHERE ";
            foreach($search_explode as $each){
                $x++;
                if($x == 1){
                   $sql .= " name LIKE '%$each%' ";}                          
                else {

                    $sql .= " AND name LIKE '%$each%' ";
                }
            }

            $sql .= " ) ";
            echo $sql;
            $q = $this->db->query($sql);
             return $q = $q->num_rows() == 0 ? FALSE :  $q->result();
        }

当我搜索exapmle时

“mali oglasi”

我收到以下错误：

错误号码：1064

您的SQL语法有错误;检查手册   对应于您的MySQL服务器版本，以便使用正确的语法   在'AND name LIKE'％mali％'附近并命名为'％oglas％'）UNION ALL（   选择名称，第1行的id_e'

这是它正在生成的MySQL查询：

( SELECT name, id_global_info AS id, body AS body, tag AS tag ,info_type_id AS info_type, "global_info" AS mytable FROM global_info WHERE name LIKE '%mali%' AND name LIKE '%oglas%' )
 UNION ALL
 ( SELECT name, id_person AS id, surname AS body, info AS tag , location AS info_type, "person" AS mytable FROM person WHERE AND name LIKE '%mali%' AND name LIKE '%oglas%' ) 
UNION ALL
 ( SELECT name, id_event AS id, body AS body, caffe_id AS tag , date AS info_type, "event" AS mytable FROM event WHERE AND name LIKE '%mali%' AND name LIKE '%oglas%' ) 
UNION ALL
 ( SELECT name, id_caffe AS id, description AS body, adress AS tag, location_id AS info_type, "caffe" AS mytable FROM caffe WHERE AND name LIKE '%mali%' AND name LIKE '%oglas%' )

什么似乎是错误？

Answer 1

第一件事是第一件事：不要忘记逃避你的输入值。这可以在你的情况下在初始值或$each上的foreach循环的每次迭代中完成

// If your query() method calls mysql_query()
$keyword = mysql_real_eascape_string(trim($_POST['keyword']));
// Or if query() is mysqli::query()
$keyword = $this->db->real_escape_string(trim($_POST['keyword']));
// Or if this is Codeigniter's API
$keyword = $this->db->escape_like_str(trim($_POST['keyword']));

您需要在每个$x循环的开头重置foreach：

       // Reset $x to 0 before the start of each of your loops.
       $x = 0;
       foreach($search_explode as $each){
            $x++;
            if($x == 1){
               $sql .= " name LIKE '%$each%' ";}                          
            else {

                $sql .= " AND name LIKE '%$each%' ";
            }
        }

注意：通常建议使用参数化查询，而不是通过连接和插值来构建查询。 Codeigniter使用?占位符。

Answer 2

您的查询错误位于第二，第三和第四个SELECT语句中，因为您有WHERE AND name而不是WHERE name

执行SELECT查询时出现MySQL错误1064

2 个答案: