This doesn't show questions without answers
SELECT
M.id, M.j_surname,
Q.id as qid, Q.qus_view_count, Q.qus_owner, Q.qus_title, Q.qus_description,
Q.qus_createddate,
COUNT(A.qus_id) as ans_count,
A.qus_id FROM jt_questions Q
LEFT JOIN jt_members M ON M.id = Q.qus_owner
LEFT JOIN jt_answers A ON Q.id = A.qus_id
GROUP BY A.qus_id
ORDER BY Q.qus_createddate DESC
LIMIT $offset, $records开发者_JS百科PerPage;
Try GROUP BY Q.id
not GROUP BY A.qus_id
For unanswered questions A.qus_id
will all have a value of NULL
$offset = "1; drop table jt_answers; --";
EDIT
if what you did in your code looked like this:
$SQL = "SELECT
M.id, M.j_surname,
Q.id as qid, Q.qus_view_count, Q.qus_owner, Q.qus_title, Q.qus_description,
Q.qus_createddate,
COUNT(A.qus_id) as ans_count,
A.qus_id FROM jt_questions Q
LEFT JOIN jt_members M ON M.id = Q.qus_owner
LEFT JOIN jt_answers A ON Q.id = A.qus_id
GROUP BY A.qus_id
ORDER BY Q.qus_createddate DESC
LIMIT $offset, $recordsPerPage;";
All I would need to do is to get $offset to look like my original answer above. That would drop your jt_answers table.
You could validate these values, such as making sure $offset is a positive integer.
But really you should use MySQLi's parameter binding instead. That would replace the variables with ? and let you pass the variables into it so the database can decide how to handle them.
http://www.php.net/manual/en/mysqli-stmt.bind-param.php
精彩评论