MySQL查询基于用户输入

Question

我有一个数据库表.我想创建一个文本输入,用户可以在其中输入"uid",查询将返回与该uid相关联的行.

所以,假设我有这样的事情:

$query = "SELECT name,age FROM people WHERE uid = '2' LIMIT 0,1";
$result = mysql_query($query);
$res = mysql_fetch_assoc($result);

echo $res["age"];

如何将该查询修改为类似的...

SELECT name, age 
  FROM people 
 WHERE uid = $_POST['blahblah'] LIMIT 0,1

在此先感谢您的帮助!

Answer 1

事实上...

// Read input from $_POST
$uid = (isset($_POST['uid']) ? $_POST['uid'] : '');

// Build query.  Properly escape input data.
$query = 
  "SELECT name,age " .
  "FROM people " .
  "WHERE uid = '" . mysql_real_escape_string($uid) . "' " . 
  "LIMIT 0,1";

出于安全原因,建议转义变量中的字符.看一下这个文档的原因有以下几点:

http://en.wikipedia.org/wiki/SQL_injection