函数与字符串参数

Question

I have function

function count_where($param, $value)
{
    $result=mysql_query("SELECT COUNT(*) AS TOTAL FROM vote WHERE '$param'='$value'");
    $data=mysql_fetch_assoc($result);
    return $data['TOTAL'];
}

and try to call it

count_where('picture','black circle')

where picture has varchar type (in MySQL). It doesn't work.

This

$result=mysql_query("SELECT COUNT(*) AS TOTAL FROM vote WHERE picture='black circle'");
 $data=mysql_fetch_assoc($result);
 echo $data['TOTAL'];

work;

Answer 1

if you want to encapsulate the column name, use backticks ` instead of apostrophes '

But be careful, watch out for sql injection. Before running the query you can better do:

$param = mysql_real_escape_string($param);
$value = mysql_real_escape_string($value);