传递字符串时PHP MySQL查询错误

Question

嗨我有一个MySQL查询没有传递字符串变量的问题.

如果$pass只包含数字,它可以正常工作.当它包含字母时,我收到Cannot execute the query错误.

例:

$pass=123456     //works fine
$pass=z23456     //cannot execute the query
$_SESSION['id']=$pass;           //start session

if (isset($_SESSION['id'])) {

// Query database for user information.
$query = "SELECT RepName FROM RepTable WHERE RepNumber = 
".$_SESSION['id']."";
$result = mysql_query ($query) OR die ('Cannot execute the query.');
$rinfo = mysql_fetch_array ($result);
$RepInfo = $rinfo[0]; 

Answer 1

试试:

'".$_SESSION['id']."'"

代替 :

".$_SESSION['id'].""

你还可以添加:

mysql_escape_string($_SESSION['id'])