php 带有 $variable 的 LIKE 运算符
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1843640/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
LIKE operator with $variable
提问by skarama
This is my first question here and I hope it is simple enough to get a quick answer!
这是我在这里的第一个问题，我希望它足够简单，可以快速得到答案！
Basically, I have the following code:
基本上，我有以下代码：
$variable = curPageURL();
$query = 'SELECT * FROM `tablename` WHERE `columnname` LIKE '$variable' ;
If I echo the $variable, it prints the current page's url( which is a javascript on my page)
如果我回显 $variable，它会打印当前页面的 url（这是我页面上的 javascript）
Ultimately, what I want, is to be able to make a search for which the search-term is the current page's url, with wildcards before and after. I am not sure if this is possible at all, or if I simply have a syntax error, because I get no errors, simply no result!
最终，我想要的是能够进行搜索，搜索词是当前页面的 url，前后都带有通配符。我不确定这是否可能，或者我是否只是有语法错误，因为我没有错误，根本没有结果！
I tried :
我试过 ：
$query = 'SELECT * FROM `tablename` WHERE `columnname` LIKE '"echo $variable" ' ;
But again, I'm probably missing or using a misplaced ' " ; etc.
但同样，我可能遗漏了或使用了错位的 '" ; 等。
Please tell me what I'm doing wrong!
请告诉我我做错了什么！
回答by ceejayoz
Ultimately, what I want, is to be able to make a search for which the search-term is the current page's url, with wildcards before and after.
最终，我想要的是能够进行搜索，搜索词是当前页面的 url，前后都带有通配符。
The SQL wildcard character is a percent sign. Therefore:
SQL 通配符是一个百分号。所以：
$variable = curPageURL();
$variable = mysql_real_escape_string($variable);
$query = "SELECT * FROM `tablename` WHERE `columnname` LIKE '%{$variable}%'";
Note: I've added in an extra bit of code. mysql_real_escape_string()will protect you from users deliberately or accidentally putting characters that will break your SQL statement. You're better off using parameterised queries, but that's a more involved topic than this simple fix.
注意：我添加了一些额外的代码。mysql_real_escape_string()将保护您免受用户故意或意外放置会破坏您的 SQL 语句的字符。最好使用参数化查询，但这比这个简单的修复更复杂。
Also note: I've fixed your string quoting, too. You can only use a variable in a string directly if that string is double quoted, and you were missing a quote at the end of $query.
另请注意：我也修复了您的字符串引用。如果字符串是双引号，则只能直接在字符串中使用变量，并且在$query.
edit 17 Jan 2015:Just got an upvote, so with that in mind, pleasedon't use the mysql_*functions anymore.
2015 年 1 月 17 日编辑：刚刚得到一个赞成票，所以请记住这一点，请不要再使用这些mysql_*功能。
回答by OMG Ponies
Use:
用：
$query = "SELECT * FROM `tablename` WHERE `columnname` LIKE '{$variable}'" ;
To get an idea of why to prevent SQL injection attacks, like the above would be vulnerable to, I submit "Exploits of a Mom":
为了了解为什么要防止 SQL 注入攻击，就像上面那样容易受到攻击，我提交了“妈妈的漏洞”：
回答by Cade Roux
Please don't do this, it is vulnerable to SQL injection (this is a list of 138 StackOverflow questions you should read, absorb and understand prior to returning to your application). Use parametrized queries or stored procedures.
请不要这样做，它很容易受到SQL 注入的攻击（这是一个包含 138 个 StackOverflow 问题的列表，您在返回应用程序之前应该阅读、吸收和理解）。使用参数化查询或存储过程。
回答by Ivan Nevostruev
Use double quotesif you need to substitute variable values:
如果需要替换变量值，请使用双引号：
## this code is open for SQL injection attacks
$query = "SELECT * FROM `tablename` WHERE `columnname` LIKE '$variable'";
Or concat string manually:
或手动连接字符串：
## this code is open for SQL injection attacks
$query = 'SELECT * FROM `tablename` WHERE `columnname` LIKE "' . $variable . '"';
回答by streetparade
Your code is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query string. Instead, it must first be sanitized with a function such as mysql_real_escape_string().
您的代码容易受到 SQL 注入攻击。永远不应将用户提供的数据直接放入 SQL 查询字符串中。相反，它必须首先使用诸如mysql_real_escape_string().
回答by Paul Lammertsma
As to why you're not being notified of the syntax error: It's fairly likely that your error reporting settings aren't set up correctly.
至于为什么您没有收到语法错误的通知：很可能您的错误报告设置没有正确设置。
Open php.iniand make sure the following is set:
打开php.ini并确保设置了以下内容：
display_errors = On
And:
和：
error_reporting = E_ALL
