会话变量在MySQL语句中不起作用

I am trying to use session variable($_SESSION['asc_id'], which holds some value like "AS0027001") in an SQL statement, but it is not working. When I hardcode the value, it is providing results.

Can anyone please correct me.

MySQL query which is not working

$asc_id = $_SESSION['asc_id'];

$rs = mysql_query('select asc_lastname, asc_firstname, asc_middlename, lname_fname_dob
                     from issio_asc_workers where asc_user_type = 31
                      and asc_id  = "$asc_id"
                      and lname_fname_dob like "' .
                      mysql_real_escape_string($_REQUEST['term']) .
                      '%"  order by lname_fname_dob asc limit 0,10', $dblink);

Mysql query which is working

$rs = mysql_query('select asc_lastname, asc_firstname, asc_middlename, lname_fname_dob 
                     from issio_asc_workers where asc_user_type = 31
                      and asc_id  = "AS0027001" and lname_fname_dob like "' .
                      mysql_real_escape_string($_REQUEST['term']) .
                      '%"  order by lname_fname_dob asc limit 0,10', $dblink);

When you print the strings, it will be clear. When the question is reformatted to leave the SQL readable, the problem is clear. (The first rule for debugging SQL statements is "print the string". A second rule, that makes it easier to comply with the first, is always put the SQL statements into a string which you pass to the SQL function.)

You use the . notation to embed the request term in the string; you don't use that to embed the $asc_id into the string. You should also use mysql_real_escape_string() on the session ID value to prevent SQL injection.

Variable substitution only works within double quoted strings, not single quoted ones. In other words, you should do;

$rs = mysql_query("select .... and asc_id  = '$asc_id' and ... limit 0,10", $dblink);

Btw, you did make sure the value doesn't include any characters that may lead to SQL injection, right? Otherwise you should use mysql_real_escape_string to make sure before inserting it into a query.

First print the variable $asc_id . If it displays nothing, session is unavailable . In that case you missed session_start() in top of the current executing page .

From the SQL query, you cannot replace the value of a variable inside single quoted string . Use . symbol for mixing string value with variable or use double quoted string . I prefer first one .

For troubleshooting , simplest method is printing variable values. From the result , you will understand what is missing .

Thanks

Try this. from the comment you added, I modified it like this

session_start(); //add this if you did not do it yet

$asc_id = $_SESSION['asc_id'];

$rs = mysql_query("select asc_lastname, asc_firstname, asc_middlename, lname_fname_dob
                 from issio_asc_workers where asc_user_type = 31
                  and asc_id  = '$asc_id'
                  and lname_fname_dob like '".
                  mysql_real_escape_string($_REQUEST['term']) .
                  "%'  order by lname_fname_dob asc limit 0,10", $dblink);