我正在尝试为用户输入编写准备好的语句。参数数量根据用户输入而变化。 Oam 正在尝试此代码
PHP 代码：
2
1018$string = "my name";
$search_exploded = explode( " ", $string );
$num = count( $search_exploded );
$cart = array();
for ( $i = 1; $i <= $num; $i ++ ) {
$cart[] = 's';
}
$str = implode( '', $cart );
$inputArray[] = &$str;
$j = count( $search_exploded );
for ( $i = 0; $i < $j; $i ++ ) {
$inputArray[] = &$search_exploded[ $i ];
}
print_r( $inputArray );
foreach ( $search_exploded as $search_each ) {
$x ++;
if ( $x == 1 ) {
$construct .= "name LIKE %?%";
} else {
$construct .= " or name LIKE %?%";
}
}
$query = "SELECT * FROM info WHERE $construct";
$stmt = mysqli_prepare( $conn, $query );
call_user_func_array( array( $stmt, 'bind_param' ), $inputArray );
if ( mysqli_stmt_execute( $stmt ) ) {
$result = mysqli_stmt_get_result( $stmt );
if ( mysqli_num_rows( $result ) > 0 ) {
echo $foundnum = mysqli_num_rows( $result );
while( $row = mysqli_fetch_array( $result, MYSQLI_ASSOC ) ) {
echo $id = $row['id'];
echo $name = $row['name'];
}
}
}
当我 print_r($inputArray) 时，输出为：
Array ( [0] => ss [1] => my [2] => name )
错误日志中没有显示错误。
出了什么问题？
Copyright 2014-2026 https://www.php.cn/ All Rights Reserved | php.cn | 湘ICP备2023035733号
收藏
编写一个通用查询处理程序并向其传递您的查询、参数数组和参数类型列表。返回一组结果或消息。这是我自己的 mysqli 个人版本（我主要使用 PDO，但也为此设置了类似的功能）。对插入、更新和删除执行相同的操作。然后只需维护您的一个库并将其用于您所做的所有事情:) 请注意，如果您以此开始，您可能希望更好地处理连接错误等。
connect_error) { return false; } return $con; } // generic select function. // takes a query string, an array of parameters, and a string of // parameter types // returns an array - // if $retVal[0] is true, query was successful and returned data // and $revVal[1...N] contain the results as an associative array // if $retVal[0] is false, then $retVal[1] either contains the // message "no records returned" OR it contains a mysql error message function selectFromDB($query,$params,$paramtypes){ // intitial return; $retVal[0]=false; // establish connection $con = getDBConnection(); if(!$con){ die("db connection error"); exit; } // sets up a prepared statement $stmnt=$con->prepare($query); $stmnt->bind_param($paramtypes, ...$params); $stmnt->execute(); // get our results $result=$stmnt->get_result()->fetch_all(MYSQLI_ASSOC); if(!$result){ $retVal[1]="No records returned"; }else{ $retVal[0]=true; for($i=0;$iclose();
return $retVal;
}
$myusername=$_POST['username'];
$mypassword=$_POST['password'];
// our query, using ? as positional placeholders for our parameters
$q="SELECT useridnum,username FROM users WHERE username=? and password=?";
// our parameters as an array -
$p=array($myusername,$mypassword);
// what data types are our params? both strings in this case
$ps="ss";
// run query and get results
$result=selectFromDB($q,$p,$ps);
// no matching record OR a query error
if(!$result[0]){
if($result[1]=="no records returned"){
// no records
// do stuff
}else{
// query error
die($result[1]);
exit;
}
}else{ // we have matches!
for($i=1;$i$val){
print("key:".$key." -> value:".$val);
}
}
}
?>