这是按预期工作的PHP代码的摘录。
但是我想修改 sql 查询。内部连接 b，c，d，e 不应是查询的一部分，除非设置了相应的第一、第二、第三变量。
$word_first=$_GET["first"];
$word_second=$_GET["second"];
$word_third=$_GET["third"];
$word_forth=$_GET["forth"];
$word_fifth=$_GET["fifth"];
$word_sixth=$_GET["sixth"];
$word_seventh=$_GET["seventh"];
$word_eighth=$_GET["eighth"];
$query="select id, word from toprint as a
inner join syl as b on b.word_id = a.id and b.char_id = '1' AND b.mychar LIKE '%".$word_first. "%'
inner join syl as c on c.word_id = a.id and c.char_id = '2' AND c.mychar LIKE '%".$word_second. "%'
inner join syl as d on d.word_id = a.id and d.char_id = '3' AND d.mychar LIKE '%".$word_third. "%'
inner join syl as e on e.word_id = a.id and e.char_id = '4' AND e.mychar LIKE '%".$word_forth. "%'
inner join syl as f on f.word_id = a.id and f.char_id = '5' AND f.mychar LIKE '%".$word_fifth. "%'
inner join syl as g on g.word_id = a.id and g.char_id = '6' AND g.mychar LIKE '%".$word_sixth. "%'
inner join syl as h on h.word_id = a.id and h.char_id = '7' AND h.mychar LIKE '%".$word_seventh. "%'
inner join syl as i on i.word_id = a.id and i.char_id = '8' AND i.mychar LIKE '%".$word_eighth. "%'
limit 2000";
<?php
$word_fifth=mysql_real_escape_string($_GET["fifth"]);
$word_sixth=mysql_real_escape_string($_GET["sixth"]);
$word_seventh=mysql_real_escape_string($_GET["seventh"]);
$word_eighth=mysql_real_escape_string($_GET["eighth"]);
$query="select id, word from toprint as a";
if(isset($_GET["first"]))
{
$query.="inner join syl as b on b.word_id = a.id and b.char_id = '1' AND b.mychar LIKE '%".mysql_real_escape_string($_GET["first"]). "%' ";
}
if(isset($_GET["second"]))
{
$query.="inner join syl as c on c.word_id = a.id and b.char_id = '1' AND c.mychar LIKE '%".mysql_real_escape_string($_GET["second"]). "%' ";
}
if(isset($_GET["third"]))
{
$query.="inner join syl as d on b.word_id = a.id and d.char_id = '1' AND d.mychar LIKE '%".mysql_real_escape_string($_GET["third"]). "%' ";
}
if(isset($_GET["forth"]))
{
$query.="inner join syl as e on e.word_id = a.id and d.char_id = '1' AND e.mychar LIKE '%".mysql_real_escape_string($_GET["forth"]). "%' ";
}
$query.="inner join syl as f on f.word_id = a.id and f.char_id = '5' AND f.mychar LIKE '%".$word_fifth. "%'
inner join syl as g on g.word_id = a.id and g.char_id = '6' AND g.mychar LIKE '%".$word_sixth. "%'
inner join syl as h on h.word_id = a.id and h.char_id = '7' AND h.mychar LIKE '%".$word_seventh. "%'
inner join syl as i on i.word_id = a.id and i.char_id = '8' AND i.mychar LIKE '%".$word_eighth. "%'
limit 2000";
？>
如果您可以控制表单，我建议将字段更改为如下所示：
<input type="..." name="word[2]" />
然后在你的PHP中，你可以简单地做：
foreach($_GET['word'] as $number => $value) {
$table = 'syl' . intval($number);
$query .= 'INNER JOIN syl AS ' . $table . ' ON a.id = ' . $table . '.id AND ' . $table . '.char_id = '. intval($number) . ' AND ' . $table . ".mychar LIKE '%" . mysql_real_escape_string($value) . "%'";
}
除了无限可扩展之外，它还减少了代码。
无论您做什么，都不要忘记包含 mysql_real_escape_string ，因为没有它，您将允许访问者将他们想要的任何任意 SQL 注入您的查询中。