MySQL在存储过程中准备更新语句答案

【问题标题】：MySQL Prepared Statment of Update in Stored ProcedureMySQL在存储过程中准备更新语句
【发布时间】：2016-01-04 09:31:40
【问题描述】：

我必须更新多个数据库中的多个表记录。当我使用准备好的语句并执行它时它不起作用。但是当我执行该语句时它会起作用。

set @u = concat("Update `",pDB_NAME,"`.`",pTABLE_NAME,"` set 
        `NAME` ='",pNAME,"',
        `FATHER` ='",pFATHER,"',
        `REGNO` ='",pREGNO,"',
        `SEX` ='",pSEX,"',
        `STATUS` ='",pSTATUS,"',
        `DOB` ='",pDOB,"',
        `DISTT` ='",pDISTT,"',
        `NOC_ISSUED` ='",pNOC_ISSUED,"',
        `ADDRESS` ='",pADDRESS,"',
        `CONTACTNO` ='",pCONTACTNO,"',
        `CNIC` ='",pCNIC,"',
        `FCNIC` ='",pFCNIC,"',
        `SPECIALITY` ='",pSPECIALITY,"',
        `NATIONALITY` ='",pNATIONALITY,"',
        `RELIGION` ='",pRELIGION,"',
        `MEDIUM` ='",pMEDIUM,"',
        `DISTT_CODE` ='",pDISTT_CODE,"',
        `TEH_CODE` ='",pTEH_CODE,"'

          WHERE RNO='",pRNO,"';");
           PREPARE stmt3 FROM @u;

The following statement returns perfect query

   select @u;

But there is no result of the following section

        EXECUTE stmt3;
        DEALLOCATE PREPARE stmt3;

【问题讨论】：

这里没有结果意味着没有发生更新或没有执行sql查询或执行但没有返回no。更新的行数？
是的，查询没有被执行。它没有更新记录。

标签： mysql stored-procedures prepared-statement

【解决方案1】：

不要通过在带引号的字符串中将变量值括在引号中来引用列值。它很草率，它可以掩盖错误，并为 SQL 注入打开了大门。使用QUOTE() 函数。

    ...
    `NAME` =",QUOTE(pNAME),",
    `FATHER` =",QUOTE(pFATHER),",
    `REGNO` =",QUOTE(pREGNO),",
    ...

此构造还可以正确处理转义和 NULL 值，而天真的引用连接则不能。

http://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_quote

【讨论】：