msqli_query 中的 $_SESSION 变量

Question

我正在尝试在 mqsli_query 语句中使用会话变量，但它不起作用

$result = mysqli_query($link, 'SELECT book_ID, Title, username as author from users,books
here users.user_ID = books.user_ID and username = "{$_SESSION['sess_username']}"' );

我尝试为 username = "" 使用真实值，它可以工作，因此这意味着查询很好。当我尝试使用会话变量时它不起作用

将用户名设置为实际值时的示例代码：

$result = mysqli_query($link, 'SELECT book_ID, Title, username as author from users,books
here users.user_ID = books.user_ID and username = "kllew"' );

Answer 1

试试这个：（将会话放在 var 中，并更改您使用单引号的方式。

$session = $_SESSION['sess_username'];
$result = mysqli_query($link, "SELECT book_ID, Title, username as author from users,books
here users.user_ID = books.user_ID and username = '$session'" );

Answer 2

这里的“正确”方法是准备好的语句。您再也不需要将字符串连接到 SQL 查询中或担心引号。

$query = $link->prepare('SELECT book_ID, Title, username as author from users,books
    where users.user_ID = books.user_ID and username = ?');
$books = array();

if($query){
    // Bind the value to the `?`
    $query->bind_param('s', $_SESSION['sess_username']);
    $query->execute();
    // These variables will be created and populated with your values
    $query->bind_result($book_ID, $title, $author);
    while($query->fetch()){
        // Each time `fetch()` is, called, the variables will be
        // automagically updated with the next row's value
        // This while loop will run for each row, then stop
        $books[] = array(
            'book_ID' => $book_ID,
            'title' => $title,
            'author' => $author
        );
    }
}
else{
    die($link->error);
}

var_dump($books);

文档：http://www.php.net/manual/en/mysqli.prepare.php

编辑：如果您安装了mysqlnd 驱动程序（通常称为php-mysqlnd），那么您可以这样做：

$query = $link->prepare('SELECT book_ID, Title, username as author from users,books
    where users.user_ID = books.user_ID and username = ?');
$books = array();

if($query){
    // Bind the value to the `?`
    $query->bind_param('s', $_SESSION['sess_username']);
    $query->execute();

    // This allows you to use `fetch_array` like if you had used `mysqli_query`
    $result = $query->get_result();
    $books = $result->fetch_all(MYSQLI_ASSOC);
}
else{
    die($link->error);
}

var_dump($books);