Php 如何使用PDO prepared语句使搜索表单与多个字段一起工作

大家好， 我正在尝试使搜索表单与多个字段一起工作。用户可以自由填写他希望填写的任何字段，并将其他字段留空。搜索框如下所示

底部有结果表的搜索框图像：

我知道如何在没有PDO的情况下使用旧的mysql代码。 用于搜索的PHP代码是：

<?php
if(isset($_POST['submit'])){

     // define the list of fields
$fields = array('first_name', 'last_name', 'email', 'job', 'country', 'city');
$conditions = array();

        // loop through the defined fields
        foreach($fields as $field){
            // if the field is set and not empty
            if(isset($_POST[$field]) && $_POST[$field] != '') {
                // create a new condition while escaping the value inputed by the user (SQL Injection)
                $conditions[] = "`$field` LIKE '%" . mysql_real_escape_string($_POST[$field]) . "%'";
            }
        }
  $con = mysql_connect("localhost","root","");
  if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
  mysql_select_db("php_test", $con) or die("ERROR");

        // builds the query
        $query = "SELECT * FROM people ";
        // if there are conditions defined
        if(count($conditions) > 0) {
            // append the conditions
            $query .= "WHERE " . implode (' OR ', $conditions); // you can change to 'OR', but I suggest to apply the filters cumulative
        }

      //  echo $query;
        $result = mysql_query($query);
  }
 ?>

但我很难弄清楚如何在多个字段中使用预处理语句。即使是一个正确方向的提示也会非常有用

---

提前谢谢大家

你可以像以前那样做：

$fields = array('first_name', 'last_name', 'email', 'job', 'country', 'city');
$inputParameters = array();

foreach ($fields as $field) {
    // don't forget to validate the fields values from $_POST
    if (!empty($_POST[$field])) {
        $inputParameters[$field] = '%' . $_POST[$field] . '%';
    }
}

$where = implode(' OR ', array_map(function($item) {
    return "`$item` LIKE :$item";
}, array_keys($inputParameters)));

$search = $db->prepare("SELECT `id`, `name` FROM `users` WHERE $where");
$search->execute($inputParameters);

foreach ($search->fetchAll(PDO::FETCH_ASSOC) as $row) {
    var_dump($row);
}

---

你可以这样做

$q = $_POST['q'];
$query = "SELECT `id`, `name` FROM `users` WHERE ";

// loop over submitted input keywords
foreach($keywords as $keyword){
    $query .= $keyword . " LIKE ? ";
}

$sql=$db->prepare($query);

// loop over submitted input values array
foreach($values as $k => $value){
   $sql->bindParam($k+1, '%'.$value.'%');
}

$sql->execute ();

---

谢谢你的回答。我不得不稍微修改一下，但效果不错。我必须修改这个：if（isset（$\u POST[$field]）{$inputParameters[$field]='%'。$\u POST[$field].%'；}-to-if（isset（$\u POST[$field]）&&$\u POST[$field]！=“”）{$inputParameters[$field]='%'.$\u POST[$field].%'}使用空..我已更新了答案..如果有帮助，您应该接受iy

$q = $_POST['q'];
$query = "SELECT `id`, `name` FROM `users` WHERE ";

// loop over submitted input keywords
foreach($keywords as $keyword){
    $query .= $keyword . " LIKE ? ";
}

$sql=$db->prepare($query);

// loop over submitted input values array
foreach($values as $k => $value){
   $sql->bindParam($k+1, '%'.$value.'%');
}

$sql->execute ();