PHP 多条件动态查询数据库要怎么写

This topic created in 1248 days ago, the information mentioned may be changed or developed.

V 友们下午好.
我现在正在尝试写一个 php 多条件动态查询数据库的页面,但是我现在的代码遇到了问题,访问的时候返回空白
我曾尝试百度 /谷歌过.但是没有得到解决方案
我的接口是类似这样的 baidu.com?one=1&two=2&three=3&four=4
但是有时候我不想查 one 参数,这样的话接口就是 baidu.com?two=2&three=3&four=4
他们每一个字段都有可能不是我想查询的.这样的话代码应该怎么写呢?
V 友们能否给我一些建议呢?
非常感谢!
我的代码是这样写的

PHP

代码

three

Four

12 replies • 2023-01-30 22:57:58 +08:00

sun522198558

Jan 4, 2023

foreach ($_GET as $key => $value) { }

ersic

Jan 4, 2023

我会这么写

```
<?php

$params = $_GET;

if ($params) {
$where = '';
foreach ($params as $key => $value) {
if ($where == '') {
$where = "$key = $value";
} else {
$where .= "and $key = $value";
}
}

$sql = "SELECT * FROM table where " . $where;
}

```

gesse

Jan 4, 2023

8355

Jan 4, 2023

代码相当之哇塞啊

tomczhen

Jan 4, 2023 via Android

SQL 注入了解一下。

herozzm

Jan 4, 2023

完全过滤，等着被黑

pota

Jan 4, 2023

😂 别这么写，SQL 注入分分钟就没了，用个简单点的 ORM 吧

hgc81538

Jan 4, 2023

即時寫的, 未測試

```
<?php

$one = isset($_GET['one']) ? filter_var($_GET['one']) : null;
$two = isset($_GET['two']) ? filter_var($_GET['two']) : null;
$three = isset($_GET['three']) ? filter_var($_GET['three']) : null;
$four = isset($_GET['four']) ? filter_var($_GET['four']) : null;

$wheres = [];
$params = [];

if($one !== null){
$wheres[] = "`one` = ?";
$params[] = $one;
}

if($two !== null){
$wheres[] = "`two` = ?";
$params[] = $two;
}

if($three !== null){
$wheres[] = "`three` = ?";
$params[] = $three;
}

if($four !== null){
$wheres[] = "`four` = ?";
$params[] = $four;
}

$sql = 'select * from `table`';

if($wheres){
$sql .= ' where '.implode(' and ', $wheres);
}

$mysqli = new mysqli('localhost', 'my_user', 'my_password', 'world');
$stmt = $mysqli->prepare($sql);

if($wheres){
$stmt->bind_param(implode('', array_fill(0, count($wheres), 's')), ...$params);
}

$stmt->execute();

```

spicy777

Jan 4, 2023

你库没有了 /doge

cbasil

Jan 10, 2023

<pre>
<?php
$one = addslashes($_GET['one']);
$two = addslashes($_GET['two']);
$three = addslashes($_GET['three']);
$four = addslashes($_GET['four']);
$where = '1 = 1';
if($one) $where .= " and `one` = '$none'";
if($two) $where .= " and `two` = '$two'";
$sql = "SELECT * FROM table whre ".$where;
</pre>
简单的过滤一下，

zhanshen1614

Jan 16, 2023

WHERE 后面加上 1=1 ，用 PDO ，遍历请求参数数组来实现多条件动态查询。

zero3412

Jan 30, 2023

@spicy777 都是这么过来的嘛😊