變量$art['name_news']最像一個字符串,因此如果要使用這樣的嵌入變量,它需要在SQL的引號中。如果不知道$art變量的來源,就不可能判斷您的代碼是否受到SQL注入攻擊。 所以-重寫查詢以在變量周圍使用引號: $leftournews=mysqli_query($connection,"SELECT n.`kod_news`, n.image_news`, n.name_news, n.text_news, n.date_news, n.comments_news, n.view_news, u.name_user as nameuser FROM news n LEFT JOIN users u on u.kod_user=n.kod_user WHERE n.`name_news` <> '".$art['name_news']."' ORDER BY n.view_news DESC LIMIT 2"); 或者,使用這樣一個準備好的語句: $sql='SELECT n.`kod_news`, n.image_news`, n.name_news, n.text_news, n.date_news, n.comments_news, n.view_news, u.name_user as nameuser FROM news n LEFT JOIN us