Question

这是我的 sql 查询，它如何被参数化？

我想将“$productId”参数化为动态添加的。

$result = $app->getReadDb()->query("SELECT value FROM catalog_product_entity_varchar WHERE row_id = '".$productId."' AND attribute_id = (SELECT attribute_id FROM eav_attribute WHERE attribute_code = 'name' AND entity_type_id = 4)");
$productName = $result->fetchAll();

“$app->getReadDb()”中有以下方法。

Array
(
    [0] => __construct
    [1] => prepare
    [2] => beginTransaction
    [3] => commit
    [4] => rollBack
    [5] => inTransaction
    [6] => setAttribute
    [7] => exec
    [8] => query
    [9] => lastInsertId
    [10] => errorCode
    [11] => errorInfo
    [12] => getAttribute
    [13] => quote
    [14] => getAvailableDrivers
)

我不确定如何参数化上述查询，有什么想法可以做到吗？

我试过了

$result = $app->getReadDb()->query("SELECT value FROM catalog_product_entity_varchar WHERE row_id = '".$productId."' AND attribute_id = (SELECT attribute_id FROM eav_attribute WHERE attribute_code = 'name' AND entity_type_id = :attribute_name)");
        $productName = $app->getReadDb()->fetchAll($result, ['attribute_name' => 4]);
        print_r($productName); exit;

但它不起作用

Answer 1

我不确定 parameterise 的意思。
如果您的意思是将 $productId 连接到 sql 而不是使用 php str concat，则可以像这样使用 PDO PrepareStatement。

$sql = "SELECT value FROM catalog_product_entity_varchar WHERE row_id = :product_id 
        AND attribute_id = 
        (SELECT attribute_id FROM eav_attribute WHERE attribute_code = 'name' AND entity_type_id = :attribute_name)"
$statement = $app->getReadDb()->prepare($sql);
$statement->execute(array(':product_id'=>$productId,':attribute_name'=>4));
$productName = statement->fetchAll();
print_r($productName); exit;

如果您的意思不是 $productId 一直存在，您需要根据 $productId 更改 sql，这是一个典型的解决方案

$sql = "SELECT value FROM catalog_product_entity_varchar WHERE 1=1";
if($productId){
    $sql .= " and row_id ='{$productId}'";
}
if($attributeName){
    $sql .= " and attribute_id = 
    (SELECT attribute_id FROM eav_attribute WHERE attribute_code = 'name' AND entity_type_id = {$attributeName})";
}
$result = $app->getReadDb()->query($sql);
$productName = $result->fetchAll();
print_r($productName); exit;

PHP - 参数化 sql 表查询

1 个答案: