参数化sql查询

Question

我有以下功能，我试图从 SQL 注入中保护，但我不断收到错误，有什么想法吗？function get_main_info($application_id){    if (!isset($_SESSION)) session_start();    $conn = create_connection();    $user_id = $_SESSION['user_id'];    $query = "SELECT * from application  where id = :application_id and created_by= :user_id";    var_dump($application_id);die();    $row = $conn->query($query)->fetch();    $row->bindValue(':application_id', $application_id);    $row->bindValue(':user_id', $user_id);    return $row;}

Answer 1

请检查以下是否对解决您的问题有意义：

function get_main_info($application_id){

    if (!isset($_SESSION)) session_start();

    $conn = create_connection();

    $user_id = $_SESSION['user_id'];

    /*

    $query = "SELECT * from application  where id = :application_id and created_by= :user_id";

    var_dump($application_id);die();

    $row = $conn->query($query)->fetch();

    $row->bindValue(':application_id', $application_id);

    $row->bindValue(':user_id', $user_id);

    */

    $query = $conn->prepare("SELECT * from application  where id = :application_id and created_by= :user_id");

    $query->bindValue(':application_id', $application_id, PDO::PARAM_STR);

    $query->bindValue(':user_id', $user_id, PDO::PARAM_STR);

    $query->execute();

    $row = $query->fetchAll();

    return $row;

}