使用 mysql php 进行全文搜索

Question

我正在尝试制作搜索键功能。但我没有得到以下查询的任何结果。

public function SearchKey($key,$userid)
{
     $key = mysqli_real_escape_string($this->db, $key);
     $userid = mysqli_real_escape_string($this->db, $userid); 
      
      $query = mysqli_query($this->db,"SELECT * FROM posts WHERE 
       MATCH(theKey) AGAINST('$key' IN NATURAL LANGUAGE MODE) 
       AND uid = '$userid' ORDER BY sgq_id LIMIT 5") or die(mysqli_error($this->db));
      
       while($row=mysqli_fetch_array($query)) { 
          $data[]=$row;
       }
       if(!empty($data)) { 
         return $data;
       }   
     
}

然后获取，

$search = $Data->SearchKey($key, $userid);
if($search){
   foreach($search as $data){
       echo $data['theKey'];
   }
}

例如，如果我搜索 OK005，则无法获得任何结果。我试过全文搜索功能https://dev.mysql.com/doc/refman/8.0/en/fulltext-search.html

任何人都可以在这里帮助我，我缺少什么？

Answer 1

您使用单引号来传递变量。这些不会在您的查询中展开。您最好使用准备好的语句，并使用参数/值绑定来传递变量。这也将解决您的代码似乎容易受到攻击的 SQL 注入问题。

你可以试试这样的：

// Replace comment with appropriate connection data.
$pdo = new PDO(/* your DSN etc. */);

// Your query.
$sql =
'SELECT * FROM posts WHERE ' .
'MATCH(theKey) AGAINST(? IN NATURAL LANGUAGE MODE) ' .
'AND uid = ? ORDER BY sgq_id LIMIT 5';

// Create prepared statement from query.
$statement = $pdo->prepare($sql);

// Bind the values and enforce data type.
$statement->bindValue(1, $key, PDO::PARAM_STR);
$statement->bindValue(2, $userid, PDO::PARAM_INT);

// Run query.
$statement->execute();

// Get query results.
$rows = $statement->fetchAll();

// Your magic ...