PHP+MYSQL 搜索条件使用变量时双引号的运用

Question

数据库表 : fcoa_cost有以下两个字段

cost_number char(10)

cost_groupid mediumint(3)

$_SESSION['html_where'] = "WHERE cost_groupid = 2";
$_html_where = $_SESSION['html_where'];
//分页模块
global $_pagenum,$_pagesize;
_page("SELECT DISTINCT cost_number FROM fcoa_cost $_html_where",4);

运行后，一直提示以下错误：
WHERE cost_groupid = 2SQL执行失败!Unknown column 'cost_groupid' in 'where clause'

这个是什么原因呢？要如何修改这个SQL语句呢？谢谢！

以下是分页模块的代码：

/**
 * _page() 计算分页数
 * @access public
 * @param string $_sql
 * @param int $_pagesize
 * @return void
 */
function _page($_sql,$_size){
    global $_pagenum, $_pagesize, $_page, $_pageabsolute, $_num;
    if (isset($_GET['page'])){
        $_page= $_GET['page'];
        if (empty($_page) || $_page <0 || !is_numeric($_page)){
            $_page=1;
        } else {
            $_page = intval($_page);
        }
    } else {
        $_page=1;
    }
    $_pagesize = $_size;
    $_num = _num_rows(_query($_sql));
    if ($_num == 0 ) {
        $_pageabsolute = 1;
    } else {
        $_pageabsolute = ceil($_num / $_pagesize);
    };
    if ($_page > $_pageabsolute) {
        $_page = $_pageabsolute;
    }
    $_pagenum = ($_page - 1) * $_pagesize;
}

Answer 1

我一般都是单引号操作,然后如果有需要拼接的话,则直接用英文符号 ' . '来拼接一条sql语句
比如:
$fieldVal = *;
$where = 'where field = ' . $fieldVal;
$sql = 'select * from table' . $where......;