Question

PHP sql 语句问题

$sql="select * from `admin` where `name`="'.$_POST['name'].'" and `password`= "'.$_POST['passwd'].'"";

这是我定义的SQL语句，但是系统总是报错，一旦我改成
$sql="select * from `admin` where `name`=".$_POST['name']." and `password`= ".$_POST['passwd']."";这样，得到的结果又是空的。我查了最后$sql的结果是select * from `admin` where `name`=admin and password`=123; 在MYSQL数据库中这条数据是存在的，这让我很不解，希望高手给解答下我到底错在哪？

Answer 1

$sql=" select * from admin where name='".$POST['name']."' and password='".$_POST['passwd']."'";
表明和字段名字不用加引号，字符串用单引号括起来，数值不用。

Answer 2

$sql="select * from admin where name='".$_POST['name']."' and password= '".$_POST['passwd']."'";
列名和表名不用加引号.

Answer 3

select * from `admin` where `name`=admin and password`=123;
`name`=admin 这里`name`='admin'是不是少个单引号啊，因为你的这个name字段是vchar类型的吧

Answer 4

$sql="select * from `admin` where `name`='{$_POST['name']}' and `password`= '{$_POST['passwd']}'";

Answer 5

改成这样试下看看:

$sql="select * from `admin` where `name`=''".$_POST['name']."'' and `password`= ''".$_POST['passwd']."''";

Answer 6

$sql="select * from `admin` where `name`=".$_POST['name']." and `password`= ".$_POST['passwd'];