PHP MySQL查询其中x = $变量来自函数

Why is this not working:

function listOrderComments ($factnr){
global $connection;

//$factnr = 123; //or $factnr = "123"; (Both work) 

$query = "SELECT * FROM orderstatus WHERE factuurnummer = '$factnr'"; 
$result = mysqli_query($connection, $query);

When I echo $factnr I get "123" back.

When I uncommented //$factnr = 123; my function is working.

Looked everywhere for a solution. check the type $factnr is (string).

You can go with:

$query = "SELECT * FROM orderstatus WHERE factuurnummer = ". $factnr; 

Use it correctly over "doted" concat. Following will just work fine:

$factnr = 123; 
$query = "SELECT * FROM orderstatus WHERE factuurnummer = " . $factnr; 

UPDATE:

here is $factnr is passing as argument that supposed to be integer. Safe code way is DO NOT use havvy functions even going over more complicated PDO, but just verify, is this variable integer or not before any operation with it, and return some error code by function if not integer. Here is no danger of code injection into SQL query then.

function listOrderComments ($factnr){
global $connection;

if (!is_int($factnr)) return -1

//$factnr = 123; //or $factnr = "123"; (Both work) 

$query = "SELECT * FROM orderstatus WHERE factuurnummer = " . $factnr; 
$result = mysqli_query($connection, $query);

Well if you're using a variable in your query you're opening yourself up to an injection attack for one.

If you're going to be using that variable I would recommend you use bind_param for your query

Read the PHP manual link below and you will be able to figure out the issue

http://php.net/manual/en/mysqli-stmt.bind-param.php

If you're passing in a variable to your function it should already be set so I don't understand why you're setting it to 123 anyway. So execute the sql statement and bind the parameter following the first example on the PHP docs page.

public function listOrderComments ($factnr)
{
   global $connection; 
   $query = "SELECT * FROM orderstatus WHERE factuurnummer = ?";
   $sql->prepare($query);
   $sql->bind_param("s", $factnr);
   $sql->execute();
   $result = $sql->get_result();
   $data = mysqli_fetch_all($result, MYSQLI_ASSOC);

   foreach ($data as $row) {
        print_r($row);
   }
}

Then do what you want with the result

Concatenating your code is not good practise. Your best solution is to use PDO statements. It means that your code is easier to look at and this prevents SQL injection from occuring if malice code slipped through your validation.

Here is an example of the code you would use.

<?php

 // START ESTABLISHING CONNECTION...
$dsn = 'mysql:host=host_name_here;dbname=db_name_here';
//DB username
$uname = 'username_here';
//DB password
$pass = 'password_here';

try
 {

 $db = new PDO($dsn, $uname, $pass);

 $db->setAttribute(PDO::ERRMODE_SILENT, PDO::ATTR_EMULATE_PREPARES);
 error_reporting(0);
 } catch (PDOException $ex)
 {
 echo "Database error:" . $ex->getMessage();
 }

// END ESTABLISHING CONNECTION - CONNECTION IS MADE.


 $factnr = "123" // or where-ever you get your input from.

 $query = "SELECT * FROM orderstatus WHERE factuurnummer = :factnr";

 $statement = $db->prepare($query);

 // The values you wish to put in.
 $statementInputs = array("factnr" => $factnr);

 $statement->execute($statementInputs);

 //Returns results as an associative array.
 $result = $statement->fetchAll(PDO::FETCH_ASSOC);

 $statement->closeCursor();

 //Shows array of results.
 print_r($result);
 ?>

There are several comments, thank you for that. But I cant get it to work. I inserted your code as good as possible... complete function:

   function listOrderComments ($factnr){
    global $connection; 
//$factnr = 123;
//or $factnr = "123"; 
$query = "SELECT * FROM orderstatus WHERE factuurnummer = ?";
$sql->prepare($query);
$sql->bind_param("s", $factnr);
$sql->execute();
$result = $sql->get_result();
$data = mysqli_fetch_all($result, MYSQLI_ASSOC);

echo "stage 1";
foreach ($data as $row) {
print_r($row);
echo "stage 2";
}
echo "stage 3";
    if(!$result){
        die('Query FAILED' . mysqli_error());
    }


    echo "<table class='table-fill'>";
    echo "<tbody class='table-hover'>";
    echo "<tr><th>Datum Opmerking</th><th>Opmerking</th><th>order klaar?</th></tr>";


    //while  ($row = mysqli_fetch_array($result,MYSQL_ASSOC)){
while ($row=mysqli_fetch_assoc($result)){ 
echo "<tr><td width=60px>" . $row['id'] . "
</td><td><form action=pageOrder.php>
<input name=id type=hidden value='".$row['id']."';>
<input type=submit name=submit value=" . $row['factuurnummer'] . ">
</form></td>
<td>" . $row['opmerking'] . "</td>
<td>" . $row['orderafgerond'] . "</td>
</tr>";

    }
  echo "</tbody>";
    echo "</table>";


}