开发者

Unknown column 'date_added' in 'field list'

I am attempting a LOAD DATA INFILE and getting the above error.

LOAD DATA INFILE '$file'
REPLA开发者_如何转开发CE INTO TABLE $custom_parts
FIELDS TERMINATED BY ',' ESCAPED BY '\\\\'
LINES TERMINATED BY '\\r\\n'
IGNORE 1 LINES
 (`partsno`, `mfg`, `cond`, `price`, `is_deleted`, @date_added)
   SET `date_added` = STR_TO_DATE(@date_added, '%c/%e/%Y'),
  `prtky` = REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(partsno, ' ', '' ) 
   , '\\\\', '' ) , '/', '' ) , '_', '' ) , '.', '' ) , '-', '' )

The columns of the file are so

Part Number,MFR,Condition,price,is_deleted,date_added

Whenever I run the PHP to load this, I get the error. I am entrigued as why this is occuring. I believe that it is an issue with the user variable not being assigned and I am just looking for verification.


You cannot use variables for dynamic table names.
You can only do this using prepared statements,

However
You cannot use load data infile inside a stored procedure and I'm not sure you can use it in a prepared statement either.

If you use MySQL from a higher level program (php, pascal, whatever) you can

  1. resolve the variable before constructing the query;
  2. Check the columnname against a whitelist to prevent SQL-injection
  3. Feed MySQL the expanded statement.

See this question for sample code: How to prevent SQL injection with dynamic tablenames?

Also, if you are using dynamic tablenames, escape them using ` backticks. This prevents MySQL from bombing if the tablenames contains funny chars or is a reserved word.


I answered my own question. ---- User variables may be used in most contexts where expressions are permitted. This does not currently include contexts that explicitly require a literal value, such as in the LIMIT clause of a SELECT statement, or the IGNORE N LINES clause of a LOAD DATA statement.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜