Joomla SQL语法错误

Question

我使用这个代码,我的phpMyAdmin ver - 4.0.10.2

<?php 

    $db = JFactory::getDBO();

    $pid = $forum['Review']['listing_id'];

    $ipaddress = $forum['User']['ipaddress'];

    $query = "SELECT count(ipaddress) AS addresses_found FROM threads WHERE ipaddress = {$ipaddress} AND pid = {$pid}";

    $count_ip = $db->setQuery($query)->loadResult();

    if($count_ip >= 2){
    echo '<p> Your ip repeated </ p>';
    }

    ?>

并看到此错误:

您的SQL语法有错误; 检查与MySQL服务器版本对应的手册,以便在第1行的'AND pid = 315'附近使用正确的语法SQL = SELECT count(ipaddress)AS addresses_found FROM threads WHERE ipaddress = 127.0.0.0 AND pid = 315

那是什么 ？

Answer 1

"那是什么？"

这意味着$ipaddress包含MySQL抱怨的字符,是一个字符串,而不像整数{$pid}可以保持不变(如果该列也是一个int).

WHERE ipaddress = {$ipaddress}

该$ipaddress变量需要被包裹在报价:

WHERE ipaddress = '$ipaddress'

补充说明; 您的代码很容易注入SQL.最好使用准备好的声明:

• https://en.wikipedia.org/wiki/Prepared_statement

应该有任何用户输入或交互.