带有 WHERE 子句的 Mysql SELECT 不适用于变量

Question

我正在拔头发。我有两个基本相同的主体的 SELECT 语句。第一个正在工作，而第二个在其中的 WHERE 子句中不起作用。我需要一些新鲜的眼光和建议。我去过每个论坛并阅读了每个帖子，并尝试了许多“解决方案”但无济于事。希望有人能看到我错过的东西。

$oID = zen_db_prepare_input($_GET['oID']);

  // Color coding for invoice -Start queries---

  $query = "SELECT * FROM cart1_orders WHERE orders_id = $oID";
  $result = $db->Execute($query); 
  $shiploc = $result->fields['shipping_method'];
  if ($result->RecordCount() > 0) { 
  echo 'Test Query: = ' . $result->fields['shipping_method']; 
  } else { 
  echo 'Sorry, no record found for product number ' ; 
  }  

  $sql = "SELECT * FROM cart1_store_locations  WHERE pickup_name= $shiploc";
  $results = $db->Execute($sql); 
  $newcolorblock = $results->fields['color_code'];
  if ($results->RecordCount() > 0) { 
  echo 'Color Query: = ' . $results->fields['color_code'];
  echo 'Location: = '. $results->fields['pickup_name']; 
  } else { 
  echo 'Sorry, no record found for Color Code ' ; 
  }  

提前感谢您的帮助和建议，希望您能看到我看不到的东西。

第一个查询结果：测试查询：= Store Pickup (Mooresville - Gold's Gym) 第二次查询结果：WARNING：出现错误，请刷新页面重试。

如果 WHERE 子句被删除，它会返回值但不是正确的值。我需要 WHERE 语句来提取正确的信息。

ANSWER由bloodyKnuckles提供:)

$sql= "SELECT * FROM cart1_store_locations WHERE pickup_name= $shiploc";

改为：（表数据中需要转义为comp for ）

$shiploc_escaped = mysql_escape_string($shiploc);
$sql = "SELECT * FROM cart1_store_locations  WHERE pickup_name=       '".$shiploc_escaped."'";

我以前没有使用过这个论坛。爱它！！！谢谢大家！

Answer 1

因为你的字符串中有一个单引号：

商店取货（Mooresville - Gold's Gym）

...你需要转义变量$shiploc:

$shiploc_escaped = addslashes($shiploc);
$sql = "SELECT * FROM cart1_store_locations  WHERE pickup_name= '".$shiploc_escaped."'";

阅读Zen Cart Escaping Content，看来这是一个选项：

$sql = "SELECT * FROM cart1_store_locations  WHERE pickup_name= '".$db->prepare_input($shiploc)."'";

...而且，更好的是，这个：

$sql = "SELECT * FROM cart1_store_locations WHERE pickup_name= :pickup_name:";
$sql = $db->bindVars($sql, ':pickup_name:', $shiploc, 'string');

Answer 2

您的$shiploc 可能是null。在第二次查询之前，请写信var_dump($shiploc);，让我们知道你得到了什么。

编辑

$oID = zen_db_prepare_input($_GET['oID']);

  // Color coding for invoice -Start queries---

  $query = "SELECT * FROM cart1_orders WHERE orders_id = $oID";
  $result = $db->Execute($query); 
  $shiploc = $result->fields['shipping_method'];
  if ($result->RecordCount() > 0) { 
  echo 'Test Query: = ' . $result->fields['shipping_method']; 
  } else { 
  echo 'Sorry, no record found for product number ' ; 
  }  

  $sql = "SELECT * FROM cart1_store_locations  WHERE pickup_name= '".$shiploc."'";
  $results = $db->Execute($sql); 
  $newcolorblock = $results->fields['color_code'];
  if ($results->RecordCount() > 0) { 
  echo 'Color Query: = ' . $results->fields['color_code'];
  echo 'Location: = '. $results->fields['pickup_name']; 
  } else { 
  echo 'Sorry, no record found for Color Code ' ; 
  }