在 PHP 中使用数组中的谓词进行 SQL 查询

Question

我想使用数组中的参数在 PHP 中准备一个 SQL 查询。它应该是一个准备好的语句。

假设这是我的带参数数组

$params = array("arg1" => 1, "arg2" => 0, "arg3" => 1)

我希望我的查询看起来像

SELECT * FROM table WHERE arg1 = 1 AND arg2 = 0 AND arg3 = 1

Answer 1

$qry= 'SELECT * FROM table WHERE ';
foreach($params as $key => $value)
{
    $qry .= $key . '=' . $value . ' AND ';
}
$qry = substr($qry, 0, -5); // remove last ' AND '

这应该足以让您入门。根据您运行的 MySQL/SQL/PHP 版本，您可能需要在变量周围加上引号。此解决方案不解决 SQL injection 或准备好的语句。您可以添加 ? 或 :variable，具体取决于您如何构建准备好的语句。

其他选项...您可以将数组内爆为“AND”分​​隔的字符串。请参阅堆栈溢出问题 How to use array variable into mysql query in php/mysql

Answer 2

如果您想使用 PDO 管理准备好的语句，请尝试以下代码：

<?php
    $servername = "hostname";
    $username = "username";
    $password = "password";
    $dbname = "database";

    try {
        $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);

        // Set the PDO error mode to exception
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        // Prepare SQL content
        $sql = "SELECT * FROM Persons";

        // Considering this is the array you want to use to prepare the SQL content
        $params = array("LastName" => 1, "FirstName" => 1, "Address" => 1);
        foreach($params as $attr => $val) {
            $where[] = "$attr = :$attr";
        }
        $sql .= " where " . join(' and ', $where); // *** where LastName = :LastName and FirstName = :FirstName and Address = :Address

        $stmt = $conn->prepare($sql); //  *** SELECT * FROM Persons where LastName = :LastName and FirstName = :FirstName and Address = :Address

        // Bind parameters
        foreach($params as $attr => $val) {
            $stmt->bindValue(":$attr", $val, PDO::PARAM_STR);
        }

        $stmt->execute();

        //$stmt->debugDumpParams();

        echo $stmt->rowCount();

        print_r($stmt->fetch());
    }
    catch(PDOException $e)
    {
        echo "Error: " . $e->getMessage();
    }

或者，如果您想使用 mysqli 管理准备好的语句，请尝试以下操作：

<?php
    $servername = "hostname";
    $username = "username";
    $password = "password";
    $dbname = "database";

    // Create connection
    $conn = new mysqli($servername, $username, $password, $dbname);

    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }

    $sql = "SELECT * FROM Persons";

    // Considering this is the array you want to use to prepare the SQL content
    $params = array("LastName" => 1, "FirstName" => 0, "Address" => 1);
    $sqltype = "";

    foreach($params as $attr => $val) {
        $where[] = "$attr = ?";
        $sqltype .= 's';
        $bind_val[] = $val;
    }

    $sql .= " where " . join(' and ', $where); // *** SELECT * FROM Persons where LastName = ? and FirstName = ? and Address = ?

    // Prepare SQL content
    $stmt = $conn->prepare($sql);

    // Bind parameters
    $stmt->bind_param( $sqltype, ...$bind_val ); // *** $stmt->bind_param("sss", 1, 0, 1);

    $stmt->execute();

    $result = $stmt->get_result();

    echo $result->num_rows;
    print_r($result);