sql语句中的逻辑

Question

connect1($db_host,$db_username,$db_password,$db_name1);

$q="SELECT DISTINCT
bizinfo.dbiz_id,
bizinfo.company_name,
bizinfo.company_industry,
bizinfo.company_sub_industry
FROM
bizinfo
Inner Join biz_feedback ON bizinfo.dbiz_id = biz_feedback.biz_id AND biz_feedback.on_industry = bizinfo.company_industry
ORDER BY
bizinfo.dbiz_id ASC";
$rs_q=mysql_query($q);
while($row=mysql_fetch_assoc($rs_q))
{
$dbiz_id=$row['dbiz_id'];
$company=$row['company_name'];
$company_industry=$row['company_industry'];
$company_sub_industry=$row['company_sub_industry'];

connect2($db_host,$db_username,$db_password,$db_name2);

$sql_livedb=mysql_query("UPDATE bizinfo set bizinfo.company_industry='$company_industry', bizinfo.company_sub_industry='$company_sub_industry'
WHERE bizinfo.dbiz_id='$dbiz_id'");
}

When this code is run, all rows in the company_industry and company_sub_industry columns are filled with the same data (for the first biz_id).

Somewhere a join needs to happen, but I thought I had it covered here WHERE bizinfo.dbiz_id='$dbiz_id'.

Answer 1

It isn't at all obvious what your problem is, but I would guess that there is a value in one of the variables (probably $company_sub_industry) which has a single quote embedded in it, and consequently results in the WHERE clause being ignored.

Change your code to remove the update statement and instead dump the values so you can check them. Perhaps some error checking after/in mysql_query would help.

If this is the cause, the real solution is to not generate SQL by concatenating strings and variables. Research "php avoid SQL injection" for more info.