我有一个php代码,SQL查询如下
$command = "SELECT * from {$uniluxModel} where gpm = {$uniluxGpm} AND ewt = {$uniluxEwt}";其中uniluxGpm和uniluxEwt是用户将在表单中输入的变量。我有一个数据库,其中有gpm的某些值和ex gpm的EWT值为1-5,相差0.5,例如: 1,1.5,2,2.5等,而ewt的值范围为30-100,相差10例如: 30,40,50
提前感谢
发布于 2021-10-27 19:08:39
首先,使用预准备语句,请参见How can I prevent SQL injection in PHP?
使用OR代替AND,并测试在SELECT列表中匹配的内容。
$command = "SELECT *, gpm = :uniluxGpm AS gpm_found, ewt = :uniluxEwt AS ewt_found from {$uniluxModel} where gpm = :uniluxGpm OR ewt = :uniluxEwt";
$stmt = $conn->prepare($command);
$stmt->execute([':uniluxGpm' => $uniluxGpm, ':uniluxEwt' => $uniluxEwt]);https://stackoverflow.com/questions/69743980
复制相似问题