我有一个 MariaDb/PHP 应用程序,用于从大型科学数据库中搜索生物名称(拉丁语/瑞典语)。唯一的用户文本输入是在 中提供(部分)名称textfield
,由 PHP 读取并插入到 SQL 查询中(缩写):
Select ... from Database.table x WHERE Condition AND MATCH
(x.scientific_name) AGAINST ('"full name"' IN BOOLEAN
MODE) ;
或者
Select ... from Database.table x WHERE Condition
AND x.scientific_name LIKE '%partial_name%' AND
!isnull(x.scientific_name ;
这些查询从数据库表中返回 0 个或多个结果,定义为:
scientific_name
varchar(255)
我目前没有使用参数化查询(我必须使用吗?)
(MariaDb 版本 11.6.2、PHP 版本 8.2、带有 Apache2 的 Debian 12 服务器)
编辑:PHP代码:
//User input:
<input type='search' name='srcfield' id='srcfield' value='' size='45' maxlength='55' autofocus placeholder="Sök efter organism/taxon... (fågelnamn)" style='font-size:14px;background-color: #DCF7E7;'
oninput='fonblur1(srcfield)'>
//returns srcfield to a PHP var => $safein1 via js:
function fonblur1() {
var x = document.getElementById("srcfield");
...
}
//A large amount of various non-text input is used to build the dynamic SQL, e.g:
<input type="checkbox" id="cb02" name ="exakt2" onclick="" >
<label for="cb02">search exact/whole name</label></span>
//Dynamic SQL (untranslated code):
$sqlsrc = "SELECT f.`TaxonId`,f.`Taxonkategori`,f.`Vetenskapligt_namn0`,
f.`URL_till_taxoninformation` AS `URL_till_taxoninformation`,
d.Familj AS Familj, d.Slakte AS Slakte,
d.TaxonId AS TaxonId2, t.taxid, 1 AS accept , 'nosyn' AS syn
concat(d.Rike,' -› ', d.Fylum,' -› ',IFNULL(d.Klass, '~')) AS grupp,
FROM namndata.ftextsrc f
JOIN namndata.taxonid0 t using (Taxonkategori)
JOIN namndata.taxon0_T d USING (TaxonId)
WHERE f.`Vetenskapligt_namn0` LIKE '%" . $safein1 . "%' " .
" AND d.TaxonStatus='Accepterat' AND d.".$roww2['Taxonkategori'] ." = '".$roww2['Vetenskapligt_namn']."'
" . $TxIdf . "
order by grupp, d.radnr, f.`Vetenskapligt_namn0` LIMIT 0,2500;";
// Actual code, sent to MariaDb:
SELECT f.`TaxonId`,f.`Taxonkategori`,f.`Vetenskapligt_namn0`,
f.`URL_till_taxoninformation` AS `URL_till_taxoninformation`,
d.Familj AS Familj, d.Slakte AS Slakte, 'nosyn' AS syn,
d.TaxonId AS TaxonId2, t.taxid, 1 AS accept, concat(d.Rike,' -› ', d.Fylum,' -› ',IFNULL(d.Klass, '~')) AS grupp
FROM namndata.ftextsrc f JOIN namndata.taxonid0 t using (Taxonkategori)
JOIN namndata.taxon0_T d USING (TaxonId)
WHERE MATCH (f.`Vetenskapligt_namn0`) AGAINST ('"carnivora"' IN BOOLEAN MODE)
AND d.TaxonStatus='Accepterat' AND d.Fylum = 'Chordata' order by grupp, d.radnr, f.`Vetenskapligt_namn0` LIMIT 0,2500;