mysqli_query 数据库选择错误

Question

我试图从数据库中选择文本，但只选择某些用户名发布的文本。基本上我需要有人来看看这个 PHP 和 MySQL 代码，并告诉我他们看到了什么问题。我希望我已经提供了足够的信息。另外，我得到这个错误：警告：mysqli_fetch_array() 期望参数 1 是 mysqli_result，给出的字符串...谢谢！这是代码：

$followed = mysqli_query($con,"SELECT followed FROM follows WHERE follower = '$username'");

while($row = mysqli_fetch_array($followed)){

    echo $row['followed']."<br>";
    $followed = $row['followed'];

    $random = mysqli_query($con,"SELECT text FROM post WHERE user = '$followed'");

    while($row = mysqli_fetch_array($random)){
        echo "<ul><li id = 'stream-post'>";
        echo $row['text'];
        echo "</li></ul>";
        $user = $row['user'];
    }
}

Answer 1

代码中的问题是$followed是保存SQL结果的变量。在第一次获取之后，它会被一个字符串值覆盖。下次循环时，$followed 不再是对查询返回的结果集的引用。

还尝试从数组$row中检索键'user'，但该键在数组中不存在。

此外，您的代码容易受到 SQL 注入的影响，并且无法检查查询的返回是否成功。我们希望看到 prepared statements 与 bind placeholders，但至少，您应该在“不安全”值上调用 mysqli_real_escape_string 函数，并包含返回来自 SQL 文本中的函数。

---

这是我更喜欢遵循的模式示例

# set the SQL text to a variable
$sql = "SELECT followed FROM follows WHERE follower = '" 
     . mysqli_real_escape_string($con, $username) . "' ORDER BY 1"; 
# for debugging
#echo "SQL=" . $sql; 

# execute the query
$sth = mysqli_query($con, $sql);

# check if query was successful, and handle somehow if not
if (!$sth) {
    die mysqli_error($con);
}

while ($row = mysqli_fetch_array($sth)) {
    $followed = $row['followed'];
    echo htmlspecialchars($followed) ."<br>";

    # set SQL text 
    $sql2 = "SELECT text FROM post WHERE user = '"
          . mysqli_real_escape_string($con, $followed) . "' ORDER BY 1";
    # for debugging
    #echo "SQL=" . $sql2;

    # execute the query
    $sth2 = mysqli_query($con, $sql2);

    # check if query execution was successful, handle if not
    if (!$sth2) {
       die mysqli_error($con);
    }

    while ($row2 = mysqli_fetch_array($sth2)) {
        $text = $row2['text'];

        echo "<ul><li id = 'stream-post'>" . htmlspecialchars($text) . "</li></ul>";
    }
}

Answer 2

作为一个提示：第二个循环将结果分配给row，它已经保存了第一个查询中的行。使用不同的变量名：

    ...
    while($row = mysqli_fetch_array($followed)){

    echo $row['followed']."<br>";
    $followed = $row['followed'];

    $random = mysqli_query($con,"SELECT text FROM post WHERE user = '$followed'");

    while($subrow = mysqli_fetch_array($random)){
        echo "<ul><li id = 'stream-post'>";
        echo $subrow['text'];
        ....

第二个：user 列不属于任一 SELECT (... $user = $row['user'];)

我假设这是第二个查询：

     "SELECT user, text FROM post WHERE user = '$followed'"