选择查询的PHP mySQL错误

Question

很少有人在一开始就遇到同样的问题,但是,我正在重复这个问题,因为我似乎特定于EMail ID.

我有一个查询,在给定特定电子邮件ID作为输入的情况下检索密码.这是我的疑问

Select Password from userauth where user_name in (select id from users where email = 's.sriram@example.com')

从phpMyAdmin完成此查询时没有任何问题.

但是,当我通过php脚本执行此操作时,它不起作用.那个php脚本如下:

<?php

// Grab User submitted information
$email = $_POST["users_email"];
$pass = $_POST["users_pass"];

// Connect to the database
$con= mysql_connect("localhost","root","sriram123");
// Check connection
if (mysqli_connect_errno())
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
// Select the database to use
mysql_select_db("mydb",$con);

echo "Select Password from userauth where user_name in (select id from users where email = '$email')";

$result = mysql_query("Select Password from userauth where user_name in (select id from users where email = $email)");

if($result === FALSE) {
    echo "Error Occured. ";
    die(mysql_error()); // TODO: better error handling
}

while($row = mysql_fetch_array($result))
{
    echo $row['Password'];
}


mysqli_close($con);
?>

现在,当我执行它时,我收到这样的错误消息:

您的SQL语法有错误; 检查与MySQL服务器版本对应的手册,以便在第1行的"@ example.com"附近使用正确的语法

我是PHP的新手,我只是不确定为什么这个东西在phpMyAdmin中工作但是在我的PHP脚本中无效.

Answer 1

看起来你没有在变量周围加上适当的引号,但你应该用mysql_real_escape_string它来确保在查询中使用它实际上是安全的.