dsbiw2911188 2015-07-23 14:05
浏览 3
已采纳

PHP mySQLi准备失败,重复列'?'

I am attempting to prepare a statement with mysqli

$stmt = $mysqli->prepare("INSERT HIGH_PRIORITY INTO `user` (`FirstName`, `LastName`, `Department`, `Email`) SELECT * FROM (SELECT ?,?,?,?) AS tmp WHERE NOT EXISTS ( SELECT `Email` FROM `user` WHERE `Email` = ? ) LIMIT 1;");
if (!$stmt) {
    printf('errno: %d, error: %s', $mysqli->errno, $mysqli->error);
    die;
}

$statementReturnCode = $stmt->bind_param("sssss", $ssoFirstName, $ssoLastName, $ssoDepartment, $ssoEmail, $ssoEmail);
if (!$statementReturnCode) {
    printf('errno: %d, error: %s', $stmt->errno, $stmt->error);
}

$stmt->execute();
$stmt->close();

When this is run I receive the following error:

errno: 1060, error: Duplicate column name '?'

I've been able to bind in this fashion in the past, but I've never tried to bind the same column twice in a different location in the query (Email).

How can I use the same value for Email in two different locations, or is this a different issue?

To clarify what is being done with this query:

This query will be run frequently. If the user exists already in the user table, no insert should be attempted. If the user does not exist, the user should be added to the user table.

The user table has a UserID field that auto-increments. If an insert is attempted the user will not be added due to a unique constraint, but the AUTO-INCREMENT will add 1 even though the insert did not occur. This WHERE NOT EXISTS query is an attempt to mitigate this issue.

Example use:

INSERT INTO `user` (
    `user`.`FirstName`, 
    `user`.`LastName`, 
    `user`.`Department`, 
    `user`.`Email`)
SELECT * FROM (SELECT 'John', 'Doe', 'Marketing', 'John.Doe@mycorp.com') AS tmp
WHERE NOT EXISTS (
    SELECT `user`.`Email` 
    FROM `user` 
    WHERE `user`.`Email` = 'John.Doe@mycorp.com'
) LIMIT 1;

I have tested this query and it works as I had expected. The issue I'm having is with properly changing this query into a prepared statement with php.

  • 写回答

2条回答 默认 最新

  • dongqiabei7682 2016-06-29 11:40
    关注

    This cannot be done. Prepared statements using PHP's mysqli extension cannot be used for several things including:

    • Table names
    • Columns in select lists

    I was attempting to use a dynamic item in a select list which cannot be done.

    https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet#Where_prepared_statements_do_not_work

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(1条)

报告相同问题?

悬赏问题

  • ¥15 高价求中通快递查询接口
  • ¥15 解决一个加好友限制问题 或者有好的方案
  • ¥15 关于#java#的问题,请各位专家解答!
  • ¥15 急matlab编程仿真二阶震荡系统
  • ¥20 TEC-9的数据通路实验
  • ¥15 ue5 .3之前好好的现在只要是激活关卡就会崩溃
  • ¥50 MATLAB实现圆柱体容器内球形颗粒堆积
  • ¥15 python如何将动态的多个子列表,拼接后进行集合的交集
  • ¥20 vitis-ai量化基于pytorch框架下的yolov5模型
  • ¥15 如何实现H5在QQ平台上的二次分享卡片效果?