使用PHP将会话变量添加到MYSQL查询中

Question

我试图将两个变量传递给一个mysql查询,并在下面传递会话变量时遇到困难:

$check = mysql_query("SELECT * 
                      FROM Clients 
                      WHERE Username = '$new_username' 
                      AND Username != '$_SESSION['Username']'") or die(mysql_error()); 

有小费吗？提前致谢.

Answer 1

这是因为您的单引号'$_SESSION['Username']'已以会话中的值结束.改变这个'" . $_SESSION['Username'] . "'将解决问题.

Answer 2

这将工作,但这非常,非常糟糕:

$check = mysql_query("
    SELECT * 
    FROM  Clients 
    WHERE Username = '$new_username' 
    AND   Username != '{$_SESSION['Username']}'
") or die(mysql_error());

这也是可行的,也是推荐的做法:

$check = mysql_query("
    SELECT * 
    FROM  Clients 
    WHERE Username  = '" . mysql_real_escape_string($new_username) . "' 
    AND   Username <> '" . mysql_real_escape_string($_SESSION['Username']) . "'
") or die(mysql_error());