PHP MySQLi编写语句 - SELECT

Question

我的SELECT语法有问题.码:

$stmt = $this->con->prepare("SELECT ? FROM `shop_items` WHERE `id` = ?");

$stmt->bind_param("si", $what, $itemsId);

$stmt->execute();

$stmt->bind_result($res);

$stmt->fetch();

echo $res;

当我想选择"name"时,它会回显"name"而不是DB的结果.怎么解决？

Answer 1

占位符?只能在预备语句中用于替换值,而不能用于字段名称,表名称或语句.

您正在尝试将其用于字段名称.

您可以构建查询字符串

$stmt = $this->con->prepare("SELECT " . $what . " FROM `shop_items` WHERE `id` = ?");

但你必须确保你可以信任里面的东西$what,以避免sql注入.

否则你可能得到所有领域

$stmt = $this->con->prepare("SELECT * FROM `shop_items` WHERE `id` = ?");

获取关联数组中的结果(请参阅http://it1.php.net/manual/en/mysqli-result.fetch-assoc.php),然后仅获取指向的字段值$what