将 REGEXP 与 PDO (PHP) 问题一起使用

Question

我在使用 PDO 方法的 SQL 查询中使用 REGEXP 时遇到问题。当我执行该语句时，我从数据库中什么也得不到。我想免受 SQL 注入的影响，我只是在学习它。 如果我这样做（不安全的方式），它可以工作：

try {
    $db = new PDO('mysql:host=localhost;dbname='.'vodici', 'root', '');
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $stmt = $db->prepare("SELECT * FROM users WHERE vodicaky REGEXP '$a1' AND vodicaky REGEXP '$a2 ' AND vodicaky REGEXP ' $a ' AND vodicaky REGEXP ' $b1 ' AND vodicaky REGEXP ' $b '
    AND vodicaky REGEXP ' $be ' AND vodicaky REGEXP ' $c1 ' AND vodicaky REGEXP ' $c1e ' AND vodicaky REGEXP ' $c ' AND vodicaky 
    REGEXP ' $ce ' AND vodicaky REGEXP ' $d1 ' AND vodicaky REGEXP ' $d1e ' AND vodicaky REGEXP ' $d ' AND vodicaky REGEXP 
    ' $de ' AND vodicaky REGEXP ' $t'");
    $stmt->execute();

    if($stmt->execute()){
        while($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            echo $row['meno']." (".$row['id'].")<br>";
        }
    }
} catch (PDOException $e){
    echo 'ERROR PDO Exception thrown: '.$e->getMessage();
}

但是当我想以正确的方式进行操作时，我从数据库中什么也得不到。变量中的这些值是通过复选框从用户输入中插入的。当用户不选中框变量为空时，选中时变量具有 ex 值。 “D1”或“A1”。

    $vodicak = $a1."' AND vodicaky REGEXP '".$a2."' AND vodicaky REGEXP '".$a."' AND vodicaky REGEXP '".$b1."' AND vodicaky REGEXP '".$b."'
        AND vodicaky REGEXP '".$be."' AND vodicaky REGEXP '".$c1."' AND vodicaky REGEXP '".$c1e."' AND vodicaky REGEXP '".$c."' AND vodicaky 
        REGEXP '".$ce."' AND vodicaky REGEXP '".$d1."' AND vodicaky REGEXP '".$d1e."' AND vodicaky REGEXP '".$d."' AND vodicaky REGEXP 
        '".$de."' AND vodicaky REGEXP '".$t;


try {
    $db = new PDO('mysql:host=localhost;dbname='.'vodici', 'root', '');
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $stmt = $db->prepare("SELECT * FROM users WHERE vodicaky REGEXP :vodic");
    $stmt->execute();

    if($stmt->execute()){
        while($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            echo $row['meno']." (".$row['id'].")<br>";
        }
    }
} catch (PDOException $e){
    echo 'ERROR PDO Exception thrown: '.$e->getMessage();
}

我的想法和 StackOverflow 线程都用完了 :) 谢谢

Answer 1

这应该让您的代码按预期工作。然而，根据 cmets，你最好改变你的表情，这样你就不需要 15 个了！

// Define database connection parameters
$db_host = "127.0.0.1";
$db_name = "name_of_database";
$db_user = "user_name";
$db_pass = "user_password";


// Create a connection to the MySQL database using PDO
$pdo = new pdo(
    "mysql:host={$db_host};dbname={$db_name}",
    $db_user,
    $db_pass,
    [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_EMULATE_PREPARES => FALSE
    ]
);


$sql   = "
    SELECT * FROM users 
    WHERE vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
        AND vodicaky REGEXP ?
    ";
$query = $pdo->prepare($sql);

// Using `?` as placeholders in the SQL means we can pass an array of parameters
// to the `execute` method and they will be applied to the query in the order they
// appear. I.e. the first value in the array is mapped to the first `?` in the SQL
$query->execute([$a1,$a2,$a,$b1,$b,$be,$c1,$c1e,$c,$ce,$d1,$d1e,$d,$de,$t]);

while($row = $query->fetch(PDO::FETCH_ASSOC)){
    echo "{$row["meno"]} ({$row["id"]})<br>";
}