php - 无法弄清楚我的 SQL 语法有什么问题

Question

我正在 PHP 中运行以下 SQL 查询

   try {
        $sql = "INSERT INTO doc SET type = 1, 
         candID = :candID, 
         userID = ".$_SESSION['userid'].", 
         filename = ".$_FILES['file']['tmp_name'].", 
         date=date_format(curdate(), '%d/%m/%Y')";

        $s   = $pdo->prepare($sql);
        $s->bindValue(':candID', $_POST['candid']);
        $s->execute();
    }
    catch (PDOException $e) {
        $error = 'Error adding doc: ' . $e->getMessage();
        include $errorpage;
        exit();
    }

我收到以下错误:

Error adding doc: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':\xampp\tmp\phpD58B.tmp, date=date_format(curdate(), '%d/%m/%Y')' at line 5

我不太明白为什么会出现此错误。我的语法有问题吗？

Answer 1

filename = ".$_FILES['file']['tmp_name'].", 应为 filename = '".$_FILES['file']['tmp_name' ]."',

所以代码应该看起来像

try {
    $sql = "INSERT INTO doc SET type = 1, 
     candID = :candID, 
     userID = ".$_SESSION['userid'].", 
     filename = '".$_FILES['file']['tmp_name']."', 
     date=date_format(curdate(), '%d/%m/%Y')";

    $s   = $pdo->prepare($sql);
    $s->bindValue(':candID', $_POST['candid']);
    $s->execute();
}
catch (PDOException $e) {
    $error = 'Error adding doc: ' . $e->getMessage();
    include $errorpage;
    exit();
}