从表中选择多个ID [英] Select Multiple Ids from a table

问题描述

我想根据URL字符串选择一些ID，但对于我的代码，它仅显示第一个. 如果我写手册，那id就很好用.

I want to select some id's based on url string but with my code it displays only the first. If i write manual the id's it works great.

我有这样的网址 http://www.mydomain.com/myfile.php?theurl=1,2,3,4,5 (ids)

I have a url like this http://www.mydomain.com/myfile.php?theurl=1,2,3,4,5 (ids)

现在在myfile.php中，我有我的sql连接，并且:

Now in the myfile.php i have my sql connection and:

$ids = $_GET['theurl']; (and i am getting 1,2,3,4,5)

如果我使用这个:

$sql = "select * from info WHERE `id` IN (1,2,3,4,5)";
$slqtwo = mysql_query($sql);
while ($tc = mysql_fetch_assoc($slqtwo)) {
    echo $tc['a_name'];
    echo " - ";
}

我得到正确的结果.现在，如果我使用下面的代码，它将无法正常工作:

I am Getting the correct results. Now if i use the code bellow it's not working:

$sql = "select * from info WHERE `id` IN ('$ids')";
$slqtwo = mysql_query($sql);
while ($tc = mysql_fetch_assoc($slqtwo)) {
    echo $tc['a_name'];
    echo " - ";
}

有什么建议吗?

推荐答案

内插时

"select * from info WHERE `id` IN ('$ids')"

使用您的ID，您将得到:

with your IDs, you get:

"select * from info WHERE `id` IN ('1,2,3,4,5')"

...这会将您的一组ID视为一个字符串，而不是一组整数.

...which treats your set of IDs as a single string instead of a set of integers.

摆脱IN子句中的单引号，像这样:

Get rid of the single-quotes in the IN clause, like this:

"select * from info WHERE `id` IN ($ids)"

此外，别忘了您需要检查 SQL注入攻击.您的代码当前非常危险，并且有严重的数据丢失或访问风险.考虑如果有人使用以下URL调用您的网页，并且您的代码允许他们在单个查询中执行多个语句，会发生什么情况?

Also, don't forget that you need to check for SQL Injection attacks. Your code is currently very dangerous and at risk of serious data loss or access. Consider what might happen if someone calls your web page with the following URL and your code allowed them to execute multiple statements in a single query:

http://www.example.com/myfile.php?theurl=1);delete from info;-- 

这篇关于从表中选择多个ID的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！