php - 何时/如何在 mysql_query 中使用反引号和单引号？

Question

mysql_query("select ip from table1 where ip=$ip",$conn);*NOT work*  
mysql_query("select ip from table1 where ip='$ip'",$conn);*work*

有什么问题吗？

Answer 1

根据 Schema Object Names 记录:

Certain objects within MySQL, including database, table, index, column, alias, view, stored procedure, partition, tablespace, and other object names are known as identifiers.

[ deletia ]

An identifier may be quoted or unquoted. If an identifier contains special characters or is a reserved word, you must quote it whenever you refer to it. (Exception: A reserved word that follows a period in a qualified name must be an identifier, so it need not be quoted.) Reserved words are listed at Section 9.3, “Reserved Words”.

[ deletia ]

The identifier quote character is the backtick (“`”):

mysql> <strong>SELECT * FROM `select` WHERE `select`.id > 100;</strong>

If the ANSI_QUOTES SQL mode is enabled, it is also permissible to quote identifiers within double quotation marks:

mysql> <strong>CREATE TABLE "test" (col INT);</strong>
ERROR 1064: You have an error in your SQL syntax...
mysql> <strong>SET sql_mode='ANSI_QUOTES';</strong>
mysql> <strong>CREATE TABLE "test" (col INT);</strong>
Query OK, 0 rows affected (0.00 sec)

根据 String Literals 记录:

A string is a sequence of bytes or characters, enclosed within either single quote (“'”) or double quote (“"”) characters. Examples:

'a string'
"another string"

[ deletia ]

If the ANSI_QUOTES SQL mode is enabled, string literals can be quoted only within single quotation marks because a string quoted within double quotation marks is interpreted as an identifier.

Number Literals不应该被引用(尽管 MySQL 通常会处理它们，因为它会执行合适的 type conversion )； Date and Time Literals可能需要引用，具体取决于所使用的格式。

调用 functions必须永远不要被引用，否则它们将被解析为字符串文字。