插入期间的撇号(Mysql)
我通过 PHP 文本框获取数据，并使用普通的插入命令将其插入 MySQL 数据库.文本框接受用户对文本框旁边的特定登录 ID 的评论.问题是，当用户输入撇号 (') 例如句子我们必须照顾好 PC"时，会引发错误.
I am getting data though a PHP text box and inserting it into a MySQL database with a normal insert command. The text box takes in a comment frm the user for a particular Accession ID next to the text box. The problem is that when a user types in apostrophe (') for example the sentence "We have to take care of the PC's", an error is thrown.
我知道它为什么会发生，因为 SQL 假定它是该值的字符串的结尾，但我不知道如何转义它.我宁愿在 MYSQL 中转义它.
I know why its happening because the SQL assumes it as the end of the string for that value but I don't know how to escape it. I would prefer escaping it in MYSQL.
如果我在 MySQL 中对其进行转义，即使没有生成错误并且插入工作正常，它仍然可以作为 SQL 注入被利用吗?
If I escape it in MySQL can it still be exploited as SQL injection even if no error is generated and the insert works fine?
推荐答案
使用mysql_real_escape_string()，或者更好的是，使用带有 PDO.
相关文章