PHP-sql语句中有变量引号该怎么写

Question

"INSERT INTO user (open_id) VALUES ('".$fromUsername."')"

Answer 1

php中，单引号中间的内容是直接当做字符串来解析的。就算中间有变量也不会去解析。才会有下面这样写
$sql = 'INSERT INTO user (open_id) VALUES (''.$fromUsername.'')';
如果你按照下面写，你的变量会不被识别
$sql = 'INSERT INTO user (open_id) VALUES ('$fromUsername')';

双引号，解析的时候会先遍历字符串，找出变量等。。所以效率会比单引号慢
就可以直接
$sql = “INSERT INTO user (open_id) VALUES ('$fromUsername')”;
或
$sql = “INSERT INTO user (open_id) VALUES ('{$fromUsername}')”;

所以你的变量怎么写，关键取决于你 是用单引号还是双引号。

Answer 2

可以这么写，$sql = "INSERT INTO user (open_id) VALUES ('{$fromUsername}')";。当然，这样直接由变量去填充sql语句是很容易被注入的。建议用MYSQLI或者PDO占位符预处理来处理sql。

Answer 3

方法一：

 <?php
/* Execute a prepared statement by binding PHP variables */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < :calories AND colour = :colour');
$sth->bindParam(':calories', $calories, PDO::PARAM_INT);
$sth->bindParam(':colour', $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>

方法二：

 <?php
/* Execute a prepared statement by binding PHP variables */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < ? AND colour = ?');
$sth->bindParam(1, $calories, PDO::PARAM_INT);
$sth->bindParam(2, $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>

所以你的代码直接写成

 INSERT INTO user (open_id) VALUES (?);

Answer 4

@jerryjobs 说的是 PDO 预处理的 步骤. 配合PDO的单例,推荐这么写.

如果只是单纯的 拼接sql的话

"INSERT INTO user (open_id) VALUES ('{$fromUsername}')"

这么写也是一种选择, 单引号看需要.

最好在代码里 保持一种风格的写法, 易于理解