如何避免 PDO 准备语句中的转义字符“\”？ [复制]答案

【问题标题】：How to avoid escape character "\" in PDO prepared statement? [duplicate]如何避免 PDO 准备语句中的转义字符“\”？ [复制]
【发布时间】：2015-11-19 10:16:01
【问题描述】：

我有这个 SQL 查询：

$sql = "SELECT ac.id AS target_id FROM account AS ac JOIN 
               address_vod__c AS ad 
               ON (ad.account_vod__c = ac.id AND ad.primary_vod__c = 1)  
               WHERE ac.id IN (?)";

我正在尝试从数组中为IN 子句添加值，如下所示：

// $values is a huge array containing values

$params = [implode("','", $values)];
$stmt = $pdo->prepare($sql);
$stmt->execute($params);
$result = $stmt->fetchAll();

代码正在运行，但我得到了错误的 SQL：

SELECT 
    ac.id AS target_id
FROM
    account AS ac
        JOIN
    address_vod__c AS ad ON (ad.account_vod__c = ac.id
        AND ad.primary_vod__c = 1)
WHERE
    ac.id IN ('00180000017rkSfAAI\',\'0018000001GgXTtAAN\',\'0018000001GgXTYAA3')

我期望并且我看起来像：

SELECT 
    ac.id AS target_id
FROM
    account AS ac
        JOIN
    address_vod__c AS ad ON (ad.account_vod__c = ac.id
        AND ad.primary_vod__c = 1)
WHERE
    ac.id IN ('00180000017rkSfAAI','0018000001GgXTtAAN','0018000001GgXTYAA3')

如何避免 PDO 转义字符串？

【问题讨论】：

您将整个字符串放在一个值中。对于您使用的每个值，您需要有一个 ?。您需要拥有IN(?,?,?) 并分别绑定您的三个值。

标签： php mysql pdo

【解决方案1】：

你正在做ac.id IN (?)。这告诉数据库您要将 one 参数绑定到查询。如果您有多个元素，则需要多个?s：ac.id IN (?,?,?)。

您可以做的是动态添加?s，然后绑定您需要的每个参数。

$params = implode(',', array_fill(0, count($values), '?'));
$sql = "SELECT ac.id AS target_id FROM account AS ac
    JOIN address_vod__c AS ad ON (ad.account_vod__c = ac.id AND ad.primary_vod__c = 1)
    WHERE ac.id IN ({$params})";

$stmt = $pdo->prepare($sql);
$stmt->execute($values);
$result = $stmt->fetchAll();

【讨论】：

【解决方案2】：

你应该分解占位符并让 pdo 完成工作

$inArray = array_fill(0, count($values), '?');
$inExpr = implode(',', $inArray);
$sql = "... WHERE id IN ($inExpr)";

然后只需传递 $values - pdo 将为您完成剩下的工作

【讨论】：