带有查询的PHP MYSQLI问题 - SQL语法中的错误

Question

I'm trying to run this query with mysqli :

"SELECT * FROM campaigns WHERE user_id = ".$_SESSION['username']['user_id']." AND status = 'Paused'"

And I'm getting the following error :

There was an error running the query [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'Paused\'' at line 1]

I've searched for a solution but found none.

Any suggestions?

---

More code

public function query($query) {
    $query = $this->db2->real_escape_string($query);

    if(!$result = $this->db2->query($query)) {
        die('There was an error running the query [' . $this->db2->error . ']');
    }

    $this->count = $result->num_rows;

    return mysqli_fetch_all($result, MYSQLI_ASSOC);

    $result->free();
}

Answer 1

I'd really avoid query wrapper methods as they make it difficult to provide parameter values, especially to mysqli. Start with something more prescriptive, for example

public function getUserCampaigns($userId, $status) {
    $stmt = $this->db2->prepare('SELECT * FROM campaigns WHERE user_id = ? AND status = ?');
    $stmt->bind_param('is', $userId, $status);
    $stmt->execute();

    $result = $stmt->get_result();
    return $result->fetch_all(MYSQLI_ASSOC);
}

and call it with

$campaigns = $obj->getUserCampaigns($_SESSION['username']['user_id'], 'Paused');

I also highly recommend you run this before creating your mysqli connection instance

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

as this will make mysqli report errors as exceptions, thus avoiding the need to write a bunch of error checking code.