在SQL查询中结合多条件实现用户特定数据过滤

SELECT
    user.username, books.bid, name, authors, edition,
    status, approve, issue, issue_book.return
FROM user
INNER JOIN issue_book ON user.username = issue_book.username
INNER JOIN books ON issue_book.bid = books.bid
WHERE issue_book.approve = 'EXPIRED'
ORDER BY `issue_book`.`return` DESC;

SELECT ...
FROM ...
WHERE issue_book.approve = 'EXPIRED' AND user.username = '当前登录用户名'
ORDER BY ...;

<?php
session_start(); // 确保会话已启动

// 假设 $db 已经是一个 mysqli 数据库连接对象
// 例如：$db = new mysqli("localhost", "username", "password", "database");

if(isset($_SESSION['login_user'])) {
    $exp_status = 'EXPIRED';
    $current_username = $_SESSION['login_user'];

    // 1. 准备SQL语句，使用占位符 (?) 代替实际值
    $sql = "
        SELECT
            u.username, b.bid, b.name, b.authors, b.edition,
            ib.status, ib.approve, ib.issue, ib.return
        FROM user u
        INNER JOIN issue_book ib ON u.username = ib.username
        INNER JOIN books b ON ib.bid = b.bid
        WHERE ib.approve = ? AND u.username = ?
        ORDER BY ib.return DESC";

    // 2. 准备预处理语句
    if ($stmt = $db->prepare($sql)) {
        // 3. 绑定参数
        // 'ss' 表示绑定两个字符串类型参数
        $stmt->bind_param("ss", $exp_status, $current_username);

        // 4. 执行语句
        $stmt->execute();

        // 5. 获取结果集
        $res = $stmt->get_result();

        if ($res->num_rows == 0) {
            echo "<p>您没有过期的书籍。</p>";
        } else {
            echo "<table class='table table-bordered'>";
            echo "<tr style='background-color: #abb79b; color: white;'>";
            echo "<th>用户名</th><th>BID</th><th>书名</th><th>作者</th><th>版本</th><th>状态</th><th>归还日期</th>";
            echo "</tr>";
            while ($row = $res->fetch_assoc()) {
                echo "<tr style='background-color: white;'>";
                echo "<td>" . htmlspecialchars($row['username']) . "</td>";
                echo "<td>" . htmlspecialchars($row['bid']) . "</td>";
                echo "<td>" . htmlspecialchars($row['name']) . "</td>";
                echo "<td>" . htmlspecialchars($row['authors']) . "</td>";
                echo "<td>" . htmlspecialchars($row['edition']) . "</td>";
                echo "<td>" . htmlspecialchars($row['status']) . "</td>";
                echo "<td>" . htmlspecialchars($row['return']) . "</td>";
                echo "</tr>";
            }
            echo "</table>";
        }
        // 6. 关闭语句
        $stmt->close();
    } else {
        echo "<p>数据库查询准备失败: " . $db->error . "</p>";
    }
} else {
    echo "</br></br></br>";
    echo "<h2><b>请先登录。</b></h2>";
}
?>