【发布时间】：2014-03-08 05:36:40
【问题描述】：
我正在使用 php 和 mysql。我有一个名为“summary”的表，不想在 for-each 循环中使用 insert 语句。所以我写了以下代码。
所有值都连接在循环内的 userData 数组中，并将插入查询中的 userData 数组附加到名为 $sql 的变量中。
<?php
foreach ($activities as $activity) {
$userData[] = "(SELECT A.AcctDb,'" . $default->DeftReportPeriod . "', '" . $default->DeftReportBase . "', '" . $default->DeftPeriodBasis . "', '" . $default->DeftBasisAdj . "', '" . $AcctNo . "','" . $AcctTaxId . "', '" . $RevLoc . "', '" . $YTDStart . "', '" . $CurrFreq . "', '" . $Curr . "', '" . $Ytd . "', '" . $Lastcurr . "', '" . $LastYTD . "', '" . $Last12 . "', '" . $Prior12 . "', '" . $Last12diff . "', A.AcctDateOpen, A.AcctDateClosed, A.GroupCode, A.AcctHomeLoc, A.AcctBusName, A.ClassCode, '" . $Currdiff . "', '" . $Ytddiff . "', '" . $Mon['0'] . "', '" . $Mon['1'] . "', '" . $Mon['2'] . "', '" . $Mon['3'] . "', '" . $Mon['4'] . "', '" . $Mon['5'] . "', '" . $Mon['6'] . "', '" . $Mon['7'] . "', '" . $Mon['8'] . "', '" . $Mon['9'] . "', '" . $Mon['10'] . "', '" . $Mon['11'] . "','" . $Amt['0'] . "', '" . $Amt['1'] . "', '" . $Amt['2'] . "','" . $Amt['3'] . "', '" . $Amt['4'] . "', '" . $Amt['5'] . "', '" . $Amt['6'] . "', '" . $Amt['7'] . "', '" . $Amt['8'] . "', '" . $Amt['9'] . "', '" . $Amt['10'] . "', '" . $Amt['11'] . "' FROM accounts A WHERE A.AcctDb = '" . $AcctDb . "' and A.AcctTaxId='" . $AcctTaxId . "')";
}
$sql = 'INSERT INTO summary (AcctDb, SumReportPer, SumReportBase, SumPeriodBasis, SumBasisAdj, AcctNo,AcctTaxId, SumRevLoc, SumYtdStart, SumCurrFreq, SumCurrAmt, SumYtdAmt, SumLastCurr, SumLastYtd, SumLast12, SumPrior12, SumLast12Diff, SumDateOpen, SumDateClosed, SumGroupCode, SumHomeLoc, SumBusName, SumClassCode, SumCurrDiff, SumYtdDiff, SumMon01, SumMon02, SumMon03, SumMon04, SumMon05, SumMon06, SumMon07, SumMon08, SumMon09, SumMon10, SumMon11, SumMon12, SumAmt01, SumAmt02, SumAmt03, SumAmt04, SumAmt05, SumAmt06, SumAmt07, SumAmt08, SumAmt09, SumAmt10, SumAmt11, SumAmt12) SELECT ' . implode(',', $userData);
$this->db->query($sql);
?>
我的问题是，对于单个记录（打印查询），查询正在执行。
对于单条记录 - 查询成功执行
INSERT INTO summary (AcctDb, SumReportPer, SumReportBase, SumPeriodBasis, SumBasisAdj, AcctNo,AcctTaxId, SumRevLoc, SumYtdStart, SumCurrFreq, SumCurrAmt, SumYtdAmt, SumLastCurr, SumLastYtd, SumLast12, SumPrior12, SumLast12Diff, SumDateOpen, SumDateClosed, SumGroupCode, SumHomeLoc, SumBusName, SumClassCode, SumCurrDiff, SumYtdDiff, SumMon01, SumMon02, SumMon03, SumMon04, SumMon05, SumMon06, SumMon07, SumMon08, SumMon09, SumMon10, SumMon11, SumMon12, SumAmt01, SumAmt02, SumAmt03, SumAmt04, SumAmt05, SumAmt06, SumAmt07, SumAmt08, SumAmt09, SumAmt10, SumAmt11, SumAmt12)(SELECT A.AcctDb,'201310', 'R', 'C', '2', '014000956','014000956', '2200', '201211', 'M', '0', '35215.12', '10968.01', '51717.3', '35215.12', '51717.3', '-16502.18', A.AcctDateOpen, A.AcctDateClosed, A.GroupCode, A.AcctHomeLoc, A.AcctBusName, A.ClassCode, '-10968.01', '-16502.18', '', '3118.72', '2037.24', '2819.42', '1345.73', '4817.26', '8046.78', '4678.11', '59.44', '106.54', '4077.1', '4108.78','', '1', '1','1', '1', '1', '1', '1', '1', '1', '1', '1' FROM accounts A WHERE A.AcctDb = 'A' and A.AcctTaxId='014000956')
对于多条记录 - 引发错误
INSERT INTO summary (AcctDb, SumReportPer, SumReportBase, SumPeriodBasis, SumBasisAdj, AcctNo,AcctTaxId, SumRevLoc, SumYtdStart, SumCurrFreq, SumCurrAmt, SumYtdAmt, SumLastCurr, SumLastYtd, SumLast12, SumPrior12, SumLast12Diff, SumDateOpen, SumDateClosed, SumGroupCode, SumHomeLoc, SumBusName, SumClassCode, SumCurrDiff, SumYtdDiff, SumMon01, SumMon02, SumMon03, SumMon04, SumMon05, SumMon06, SumMon07, SumMon08, SumMon09, SumMon10, SumMon11, SumMon12, SumAmt01, SumAmt02, SumAmt03, SumAmt04, SumAmt05, SumAmt06, SumAmt07, SumAmt08, SumAmt09, SumAmt10, SumAmt11, SumAmt12)(SELECT A.AcctDb,'201310', 'R', 'C', '2', '014000956','014000956', '2200', '201211', 'M', '0', '35215.12', '10968.01', '51717.3', '35215.12', '51717.3', '-16502.18', A.AcctDateOpen, A.AcctDateClosed, A.GroupCode, A.AcctHomeLoc, A.AcctBusName, A.ClassCode, '-10968.01', '-16502.18', '', '3118.72', '2037.24', '2819.42', '1345.73', '4817.26', '8046.78', '4678.11', '59.44', '106.54', '4077.1', '4108.78','', '1', '1','1', '1', '1', '1', '1', '1', '1', '1', '1' FROM accounts A WHERE A.AcctDb = 'A' and A.AcctTaxId='014000956'),(SELECT A.AcctDb,'201310', 'R', 'C', '2', '014000956','014000956', '2201', '201211', 'M', '0', '13.86', '0', '15.22', '13.86', '15.22', '-1.36', A.AcctDateOpen, A.AcctDateClosed, A.GroupCode, A.AcctHomeLoc, A.AcctBusName, A.ClassCode, '0', '-1.36', '', '', '', '8.89', '', '4.97', '', '', '', '', '', '','', '', '','1', '', '1', '', '', '', '', '', '' FROM accounts A WHERE A.AcctDb = 'A' and A.AcctTaxId='014000956')
错误是 #1064 - 您的 SQL 语法有错误；检查与您的 MySQL 服务器版本相对应的手册，了解在 '(SELECT A.AcctDb,'201310', 'R', 'C', '2', '014000956','014000956', '2201' 附近使用的正确语法', '2012' 在第 1 行****
请问，我在这里做错了什么，来自 stackoverflow 社区的任何意见都可能帮助我们解决这个问题。
我已经添加了 sql fiddle http://sqlfiddle.com/#!2/7aa2467
【问题讨论】：
-
您在这里使用的是哪个数据库框架？您编写查询的方式非常令人担忧，因为您看起来不像 properly escaping 这些值。
-
您显示的两个输入语句没有任何区别。在您修复该问题时，请同时插入适当的换行符。
-
使用codeigniter框架，在那个mysql数据库（默认）一个
-
那么你会想要非常确定你已经阅读了escaping in the documentation上的部分。