php - 我如何将 php 变量放入 mysql 命令中

Question

$id1 = $_POST['number']; //here i am getting a php variable called number

$result = mysqli_query($con, "SELECT id,main FROM first WHERE ?how can i put that number right here?");

我使用ajax从另一个页面获取变量，我应该将其放入mysql命令中。我该怎么做？

Answer 1

以下是使用准备好的语句的示例:

   /* Create a new mysqli object with database connection parameters */
   $mysqli = new mysql('localhost', 'username', 'password', 'db');

   if(mysqli_connect_errno()) {
      echo "Connection Failed: " . mysqli_connect_errno();
      exit();
   }

   /* Create a prepared statement */
   if($stmt = $mysqli -> prepare("SELECT priv FROM testUsers WHERE username=?
   AND password=?")) {

      /* Bind parameters
         s - string, b - blob, i - int, etc */
      $stmt -> bind_param("ss", $user, $pass);

      /* Execute it */
      $stmt -> execute();

      /* Bind results */
      $stmt -> bind_result($result);

      /* Fetch the value */
      $stmt -> fetch();

      echo $user . "'s level of priviledges is " . $result;

      /* Close statement */
      $stmt -> close();
   }

   /* Close connection */
   $mysqli -> close();

Source

我强烈建议尽早研究准备好的陈述。