php - 如何将 PHP 变量值添加到 Between Query

Question

下面是我的查询

public function total_registration_month($from1,$to1){

    $q = $this->link->prepare('SELECT advisor, COUNT(*) as total
        FROM
        (
                SELECT advisor 
                FROM training_details 
                WHERE ndate BETWEEN $from1 AND $to1 
            UNION ALL
                SELECT advisor 
                FROM student_details 
                WHERE registereddate 
                BETWEEN $from1 AND $to1
        ) AS advisor
        GROUP BY advisor');

    $q->execute();

    $count = $q->fetchall();

    return $count;

} 

如何将传递的 from1 和 to1 值添加到从日期到日期之间。如果我直接应用变量或使用单个相当它显示错误。请帮助我任何人。

Answer 1

当您使用 PDO 时，您还应该使用像这样的参数化查询

public function total_registration_month($from1,$to1){

    $q = $this->link->prepare('SELECT advisor, COUNT(*) as total
                                FROM
                                (
                                        SELECT advisor 
                                        FROM training_details 
                                        WHERE ndate BETWEEN :fromd AND :tod 
                                    UNION ALL
                                        SELECT advisor 
                                        FROM student_details 
                                        WHERE registereddate BETWEEN :fromd1 AND :tod1
                                ) AS advisor
                                GROUP BY advisor');

    $params = array(':fromd' => $from1,':tod' => $to1,
                    ':fromd1' => $from1,':tod1' => $to1);

    $res = $q->execute($params);
    if ( ! $res ) {
        print_r( $q->errorInfo() );
        exit;
    }

    $count = $q->fetchall();
    return $count;
} 

这还消除了如何将数据连接到查询中的所有问题，因为这一切都由 PDO 负责，并且还消除了从用户接收的数据的任何 SQL 注入(inject)问题