php存储过程添加错误

Question

我想用存储过程向我的表中添加数据，但出现以下错误:

Gönder Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Teknoloji,V,,1)' at line 1' in C:\xampp\htdocs\berat\isyerikayit.php:142 Stack trace: #0 C:\xampp\htdocs\berat\isyerikayit.php(142): PDO->query('CALL isyerikayi...', 2) #1 {main} thrown in C:\xampp\htdocs\berat\isyerikayit.php on line 142

 <?php
      if (isset($_POST['gonder']))
     {
        $adi =  $_POST["adi"];
        $calismaturu =  $_POST["calismaturu"];
        $iscigucu =  $_POST["iscigucu"];
        $hizmetturu =  $_POST["hizmetturu"];
        $butce =  $_POST["butce"];
        if($calismaturu == 'V')
            {
                $sorgu= $db->query("CALL isyerikayitV($adi,$calismaturu,$iscigucu,$hizmetturu)",PDO::FETCH_ASSOC);

                echo '<script>alert("Hizmet Veren Firma Eklendi.");</script>';
            }
        else
            {
                $sorgu= $db->query("CALL isyerikayitE($adi,$calismaturu,$butce)",PDO::FETCH_ASSOC);

                echo '<script>alert("Hizmet Edilen Firma Eklendi.");</script>';
            }


     }
     ?>

我的 isyerikayitE() 和 isyerikayitV 程序是 7.

Answer 1

$iscigucu 似乎是空的:

“对应于您的 MariaDB 服务器版本，以便在 'Teknoloji,V,,1)' 附近使用正确的语法”

并且您所有的字符串变量都缺少引号:

一个快速的解决方案是:

$iscigucu =  empty($_POST["iscigucu"]) ? "''" : "'".$_POST["iscigucu"]."'";

对于他们中的每一个。

或

$iscigucu = "'".$iscigucu."'"

但是解决这个问题的正确方法是使用准备好的语句:

$call = mysqli_prepare($mysqli, 'CALL test_proc(?, ?, ?, ?)');
mysqli_stmt_bind_param($call, 'ssss', $adi,$calismaturu,$iscigucu,$hizmetturu);
mysqli_stmt_execute($call);

看看:http://php.net/manual/en/mysqli-stmt.bind-param.php