dsbiw2911188 2015-07-23 14:05
浏览 3
已采纳

PHP mySQLi准备失败,重复列'?'

I am attempting to prepare a statement with mysqli

$stmt = $mysqli->prepare("INSERT HIGH_PRIORITY INTO `user` (`FirstName`, `LastName`, `Department`, `Email`) SELECT * FROM (SELECT ?,?,?,?) AS tmp WHERE NOT EXISTS ( SELECT `Email` FROM `user` WHERE `Email` = ? ) LIMIT 1;");
if (!$stmt) {
    printf('errno: %d, error: %s', $mysqli->errno, $mysqli->error);
    die;
}

$statementReturnCode = $stmt->bind_param("sssss", $ssoFirstName, $ssoLastName, $ssoDepartment, $ssoEmail, $ssoEmail);
if (!$statementReturnCode) {
    printf('errno: %d, error: %s', $stmt->errno, $stmt->error);
}

$stmt->execute();
$stmt->close();

When this is run I receive the following error:

errno: 1060, error: Duplicate column name '?'

I've been able to bind in this fashion in the past, but I've never tried to bind the same column twice in a different location in the query (Email).

How can I use the same value for Email in two different locations, or is this a different issue?

To clarify what is being done with this query:

This query will be run frequently. If the user exists already in the user table, no insert should be attempted. If the user does not exist, the user should be added to the user table.

The user table has a UserID field that auto-increments. If an insert is attempted the user will not be added due to a unique constraint, but the AUTO-INCREMENT will add 1 even though the insert did not occur. This WHERE NOT EXISTS query is an attempt to mitigate this issue.

Example use:

INSERT INTO `user` (
    `user`.`FirstName`, 
    `user`.`LastName`, 
    `user`.`Department`, 
    `user`.`Email`)
SELECT * FROM (SELECT 'John', 'Doe', 'Marketing', 'John.Doe@mycorp.com') AS tmp
WHERE NOT EXISTS (
    SELECT `user`.`Email` 
    FROM `user` 
    WHERE `user`.`Email` = 'John.Doe@mycorp.com'
) LIMIT 1;

I have tested this query and it works as I had expected. The issue I'm having is with properly changing this query into a prepared statement with php.

  • 写回答

2条回答 默认 最新

  • dongqiabei7682 2016-06-29 11:40
    关注

    This cannot be done. Prepared statements using PHP's mysqli extension cannot be used for several things including:

    • Table names
    • Columns in select lists

    I was attempting to use a dynamic item in a select list which cannot be done.

    https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet#Where_prepared_statements_do_not_work

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(1条)

报告相同问题?

悬赏问题

  • ¥15 drone 推送镜像时候 purge: true 推送完毕后没有删除对应的镜像,手动拷贝到服务器执行结果正确在样才能让指令自动执行成功删除对应镜像,如何解决?
  • ¥15 求daily translation(DT)偏差订正方法的代码
  • ¥15 js调用html页面需要隐藏某个按钮
  • ¥15 ads仿真结果在圆图上是怎么读数的
  • ¥20 Cotex M3的调试和程序执行方式是什么样的?
  • ¥20 java项目连接sqlserver时报ssl相关错误
  • ¥15 一道python难题3
  • ¥15 牛顿斯科特系数表表示
  • ¥15 arduino 步进电机
  • ¥20 程序进入HardFault_Handler