mysql - mysql查询转义单引号

Question

我对以下 db::insert 命令有疑问。我想在 mysql 查询“in ()”部分中使用数组，但逗号已被转义。我怎么解决这个问题？

$users = [435,1671,429];
$list = implode("','", $users);

DB::insert("insert into ".
    "rejections (calendar_id, user_id, note, status) ".
    "select id as calendar_id, ?, concat(?), concat(?) ".
    "from calendar ".
    "where DATE(_date) BETWEEN ? AND ? and user_id in (?)", [$admin, $note, $status, $start_date, $end_date, $list]
);

mysql_log: 2019-05-30T16:28:51.221007Z 1815 执行插入拒绝 (calendar_id, user_id, note, status) select id as calendar_id, 2416, concat('Comment'), concat(1) from calendar where DATE(_date ) BETWEEN '2019-05-01' AND '2019-05-31' and user_id in ('435\',\'1671\',\'429')

标签： mysqlescapingquote

Answer 1

一个快速（和肮脏）的修复可能是删除单引号implode()并使用FIND_IN_SET()而不是IN()：

$users = [435,1671,429];
$list = implode(",", $users);

DB::insert("insert into ".
    "rejections (calendar_id, user_id, note, status) ".
    "select id as calendar_id, ?, concat(?), concat(?) ".
    "from calendar ".
    "where DATE(_date) BETWEEN ? AND ? and find_in_set(user_id, ?)"
, [$admin, $note, $status, $start_date, $end_date, $list]);

请注意，它可能会更慢，因为user_id不能使用索引。

如果要IN()在查询中使用，则需要为每个用户使用一个占位符：

IN (?,?,?)

并绑定每个用户 ID

[$admin, $note, $status, $start_date, $end_date, $list[0], $list[1], $list[2]]

由于您可能事先不知道 uf 用户的数量，因此您可以使用以下内容：

$users = [435,1671,429];

$usersPlaceholders = array_map(function($id) { return '?'; }, $users);
$usersPlaceholders = implode(',', $usersPlaceholders);
$params = array_merge([$admin, $note, $status, $start_date, $end_date], $users);

DB::insert("
    insert into rejections (calendar_id, user_id, note, status)
    select id as calendar_id, ?, concat(?), concat(?)
    from calendar
    where DATE(_date) BETWEEN ? AND ? and user_id in ($usersPlaceholders)
", $params);