原始查询将VARCHAR转换为SQL Server数据库在CodeIgniter中不起作用

Question

I try to do raw query in codeigniter to sql server database

$this->db->query("SELECT * FROM TableName WHERE  CONVERT(VARCHAR," .$ColumnName. ", 120) LIKE '%".$_POST['search']['value']."%'");

$_POST['search']['value'] is for search string input.

I tried to query using this string directly in navicat and it is working, however it didn't work when I apply it in codeigniter.

What might be the issue?

Answer 1

In a model - the Query builder version would look something like this:

$db = $this->db;
$db->like($ColumnName,$_POST['search']['value']);
$data = $db->get(TableName)->result_array();

Codeigniter will escape the $_POST parameter making it safe. As long as $ColumnName is never passed in by the user as well :o) In that case it would need escaping too.