如何更改基于 PHP 数组的 SQL 查询？

Posted 2023-03-29

【中文标题】如何更改基于 PHP 数组的 SQL 查询？

【英文标题】：How to change a SQL query based on PHP array?

【发布时间】：2014-08-14 18:42:24

【问题描述】：

我有一个引用 SQL 查询的 php 文件，验证返回的联系人数据是否符合某些标准，然后生成一个包含所有联系人数据的 XML 文件。部分查询允许我选择要从中提取数据的国家/地区（例如，将 WHERE tbl_vsed_unvalidated.c ='US' 添加到美国的末尾）。我一直在做的只是在运行 PHP 脚本之前编辑 SQL 查询以选择适当的国家/地区。

我现在正在研究的是一种通过 html 表单选择您想要的任何国家/地区的方法，通过 POST 方法将这些结果存储在 PHP 数组中，然后即时调用 SQL“WHERE”语句以返回选定的国家。我找到了一种方法来实现这一点，使用 $where 变量和 implode() 方法在数组中添加所有国家。我遇到的唯一问题是我使用“file_get_contents(SqlQuery.sql)”引用 SQL 查询。似乎这是引用查询的唯一方法，因为它非常大并且必须包含多个 "s 和 's。

如果 SQL 查询已经包含引号和撇号，是否有任何方法可以在 PHP 中将 SQL 查询包装在引号中？这是我想要的样子：

$query = " SELECT tbl_vsed_unvalidated.keyuid "UNIQUE ID",tbl_vsed_unvalidated.sn "LAST NAME",
           tbl_vsed_unvalidated.gskpreferredname "FIRST NAME",             
           tbl_vsed_unvalidated.initials "MIDDLE INITIAL",
           tbl_vsed_unvalidated.co "COUNTRY",-- tbl_vsed_unvalidated.preferredlanguage "PREFERRED LANGUAGE",
           tbl_vsed_unvalidated.c "CODE",
           'Business Level 1' AS "CUSTOM LABEL 1",
           tbl_vsed_unvalidated.gskglobalbusinesscategory "CUSTOM VALUE 1", 
           'Business Level 2' AS "CUSTOM LABEL 2", tbl_vsed_unvalidated.o "CUSTOM VALUE 2",
           'Business Level 3' AS "CUSTOM LABEL 3",tbl_vsed_unvalidated.ou "CUSTOM VALUE 3",
           'Department' AS "CUSTOM LABEL 4",tbl_vsed_unvalidated.gskdepartmentname "CUSTOM VALUE 4",
           'Site' AS "CUSTOM LABEL 5",tbl_vsed_unvalidated.l "CUSTOM VALUE 5", 
           'Employee ID' AS "CUSTOM LABEL 6",tbl_vsed_unvalidated.employeenumber "CUSTOM VALUE 6",
           'Resource Type' AS "CUSTOM LABEL 7",tbl_vsed_unvalidated.gskresourcetype  "CUSTOM VALUE 7",
           'Cost Center' AS "CUSTOM LABEL 8",tbl_vsed_unvalidated.departmentnumber "CUSTOM VALUE 8",
           'Office' AS "PHONE LABEL 1",
           null as "PHONE 1 COUNTRY CODE",
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.telephonenumber,'#',null),'-',null),' ',null),'+',null)
           AS "PHONE 1",             
           NULL as "PHONE EXTENSION 1",
           '2' AS "CASCADE 1",
           'Mobile' AS "PHONE 2 LABEL", 
           null as "PHONE 2 COUNTRY CODE",
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.mobile,'#',null),'-',null),' ',null),'+',null)
           AS "PHONE 2",             
           NULL as "PHONE EXTENSION 2",
           '1' AS "CASCADE 2",
           'Work' AS "EMAIL LABEL 1", tbl_vsed_unvalidated.mail AS "EMAIL 1",     
           DECODE (null,tbl_vsed_unvalidated.mobile,tbl_vsed_unvalidated.mobile, 
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.mobile,'#',null),'-',null),' 
    ',null),'+',null)||'@sms.sendwordnow.com') AS "SMS 1"      
                      FROM useradmin.VSED_UNVALIDATED_VW tbl_vsed_unvalidated
        WHERE ((((tbl_vsed_unvalidated.gskresourcetype <> 'Functional')
        OR tbl_vsed_unvalidated.gskresourcetype is null)
        AND (tbl_vsed_unvalidated.c ='US')) 
    ";

而不是这个：

    $query=file_get_contents(SQLQuery.sql);

这样我就可以在 SQL 查询的 WHERE 语句中引用 PHP 数组。我还应该提到我使用的是 Oracle 数据库，所以我使用的是 oci 而不是 mysql。

【问题讨论】：

您需要对字符串中的双引号进行转义：\"。顺便说一句，您不需要在查询中引用 php 数组；准备好的声明可以避免这种情况。

您可以使用heredoc syntax，而不是在查询周围加上引号。那么你就不需要添加任何转义了。

谢谢帕特里克，这很完美。比转义每个引用要容易得多

【参考方案1】：

你应该使用\转义字符

【参考方案2】：

$query = <<<SQL
SELECT tbl_vsed_unvalidated.keyuid "UNIQUE ID",tbl_vsed_unvalidated.sn "LAST NAME",
           tbl_vsed_unvalidated.gskpreferredname "FIRST NAME",             
           tbl_vsed_unvalidated.initials "MIDDLE INITIAL",
           tbl_vsed_unvalidated.co "COUNTRY",-- tbl_vsed_unvalidated.preferredlanguage "PREFERRED LANGUAGE",
           tbl_vsed_unvalidated.c "CODE",
           'Business Level 1' AS "CUSTOM LABEL 1",
           tbl_vsed_unvalidated.gskglobalbusinesscategory "CUSTOM VALUE 1", 
           'Business Level 2' AS "CUSTOM LABEL 2", tbl_vsed_unvalidated.o "CUSTOM VALUE 2",
           'Business Level 3' AS "CUSTOM LABEL 3",tbl_vsed_unvalidated.ou "CUSTOM VALUE 3",
           'Department' AS "CUSTOM LABEL 4",tbl_vsed_unvalidated.gskdepartmentname "CUSTOM VALUE 4",
           'Site' AS "CUSTOM LABEL 5",tbl_vsed_unvalidated.l "CUSTOM VALUE 5", 
           'Employee ID' AS "CUSTOM LABEL 6",tbl_vsed_unvalidated.employeenumber "CUSTOM VALUE 6",
           'Resource Type' AS "CUSTOM LABEL 7",tbl_vsed_unvalidated.gskresourcetype  "CUSTOM VALUE 7",
           'Cost Center' AS "CUSTOM LABEL 8",tbl_vsed_unvalidated.departmentnumber "CUSTOM VALUE 8",
           'Office' AS "PHONE LABEL 1",
           null as "PHONE 1 COUNTRY CODE",
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.telephonenumber,'#',null),'-',null),' ',null),'+',null)
           AS "PHONE 1",             
           NULL as "PHONE EXTENSION 1",
           '2' AS "CASCADE 1",
           'Mobile' AS "PHONE 2 LABEL", 
           null as "PHONE 2 COUNTRY CODE",
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.mobile,'#',null),'-',null),' ',null),'+',null)
           AS "PHONE 2",             
           NULL as "PHONE EXTENSION 2",
           '1' AS "CASCADE 2",
           'Work' AS "EMAIL LABEL 1", tbl_vsed_unvalidated.mail AS "EMAIL 1",     
           DECODE (null,tbl_vsed_unvalidated.mobile,tbl_vsed_unvalidated.mobile, 
           REPLACE(REPLACE(REPLACE(REPLACE(tbl_vsed_unvalidated.mobile,'#',null),'-',null),' 
    ',null),'+',null)||'@sms.sendwordnow.com') AS "SMS 1"      
                      FROM useradmin.VSED_UNVALIDATED_VW tbl_vsed_unvalidated
        WHERE ((((tbl_vsed_unvalidated.gskresourcetype <> 'Functional')
        OR tbl_vsed_unvalidated.gskresourcetype is null)
        AND (tbl_vsed_unvalidated.c ='US')) 
SQL;

理论上应该可行（目前无法测试）