PHP字符串拼接与MySQL语句

这个部分总是钻牛角尖、总是出错、

 public function getList($pagesize=25){
         $where = '1';
         $tableName = $this->getTableName();
         if(!empty($_GET['nick_name'])){
             $where.= " and $tableName.`nick_name` like '%".$_GET['nick_name']."%'";
         }
         if(!empty($_GET['user_name'])){
             $where.= " and $tableName.`user_name` = '".$_GET['user_name']."'";
         }

         if(!empty($_GET['stime'])){
             $stime = strtotime($_GET['stime']);
             $where .= " and ($tableName.`add_time` >= '$stime')";
         }

         if(!empty($_GET['etime'])){
             $stime = strtotime($_GET['etime']);
             $where .= " and ($tableName.`add_time` <= '$etime')";
         }

         if(!empty($_GET['status'])){
             $where .= " and $tableName.`status` = ".intval($_GET['status']);
         }
         $count = $this->where($where)->count();
         $this->countNum = $count;
         $Page = new \Think\Page($count,$pagesize);
         $this->page = $Page->show();
         $limit = $Page->firstRow.','.$Page->listRows;
         $res = $this->query("select $tableName.* from $tableName where $where order by $tableName.`service_id` desc limit $limit ");
         foreach($res as &$v){
             $v['region'] = $this->getRegion($v);
         }
         return $res;
     }

兄弟，这里的where语句什么时候你才能拼接不出错啊，时间在这儿数据库之中的存储格式是varchar，所以即使是时间戳，也需要传入是字符串，所以并非如int数据查询那般不需要“”引号。