带有 SQL 语句的 PHP 数组值

Question

在 PHP 中，我想执行一个 SQL 查询，将数组值与 SQL 语句一起传递。我做不到。

请考虑以下事项

$db = "mydatabase.sqlite";
$array = array(
              "key1" => "value1",
              "key2" => "value2",
              "key3" => "value3"
         );

try {

    $dbhandle = new PDO("sqlite:$db");
    $dbhandle->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    foreach ($array as $item) {

      $timestamp = 
      $dbhandle->exec(
              "INSERT OR REPLACE INTO table (field1, field2, field3) 
                   VALUES ('$item['key1']', '$item['key2']', '$item['key3']')"
              );
      $dbhandle = NULL;

    } 

  } 

catch(PDOException $e) {
    print "Exception : ".$e->getMessage()."\n";
  }

SQL语句如何表达？

Answer 1

将数组元素插入字符串时，不要在键周围加上引号：

          "INSERT OR REPLACE INTO table (field1, field2, field3) 
               VALUES ('$item[key1]', '$item[key2]', '$item[key3]')"

或使用带有花括号的“复杂”语法：

          "INSERT OR REPLACE INTO table (field1, field2, field3) 
               VALUES ('{$item['key1']}', '{$item['key2']}', '{$item['key3']}')"

但是，最好使用准备好的语句：

$stmt = $dbhandle->prepare("INSERT OR REPLACE INTO table (field1, field2, field3)
                            VALUES (:key1, :key2, :key3)");
$stmt->execute($item);