php--拼接SQL 语句

PHP 如何拼接 SQL 语句

• 查询

$sql = "select *  from comment where comment_id = ".$comment_fid;

或：  

$sql = "select *  from comment where comment_id = '".$comment_fid."'";

• 增加

//参数单独传递时
$sql = "insert into systemfunction (dep, fid, name) values ('".$dep."', '".$cid."', '".$name."') ";

//参数作为数组进行传递时

$params = array();//先定义参数数组
$params['name'] = $_REQUEST['name'];
$params['password'] = $_REQUEST['password'];
$params['level'] = $_REQUEST['level'];
...

public static function insert_student($params)
{
    $sql = "insert into admin (name,password, level, points, skills, projects, number, profile, keyword, time, picture, graduatetime, pageview, graduate, english, age, height, weight, school, region, realname) values ('".$params['name']."', '".$params['password']."', '".$params['level']."')";

   ....

}

• 删除

$sql = "delete from systemfunction where id = '".$id."'";

• 更新
  和插值一样，分为参数单独传递和参数数组传递两种情况

//参数单独传递时
$sql = "update systemfunction set name = '".$name."' where id = '".$cid."' ";

//参数作为数组传递
$params = array();//先定义参数数组
$params['name'] = $_REQUEST['name'];
$params['password'] = $_REQUEST['password'];
$params['level'] = $_REQUEST['level'];
...

public static function update_student($params)

{
    $update_student  = "
        name = '".$params['name']."', 
        password = '".$params['password']."', 
        level = '".$params['level']."', 
        ...

        where id = '".$params['id']."'";
        $sql  = "update admin set ".$update_student;

   ....

}