对pg_query（）有困难； 在PHP中

Question

Currently I am using Postgres with PHP. I'm writing an interface where a user can fill in a user, so it gets added to the total record of users in the database. (Very simple).

Recently I've been having alot of trouble getting the queries to work. Escaping seems to be required all the time. Just the query itself between double quotes isnt enough anymore.

I'm having trouble with the following query;

$query = pg_query($dbconnection,"INSERT INTO clients('clientid', 'name', 'ipaddress',     'status') VALUES ('$clientid', '$name', '$ipaddress', '$status' ");

This doesn't work. I guess there's more escaping needed. Is there any third party tool available to check if these postgres syntaxes are valid or not?

If not, how can I exactly turn this query into a useable one?

Answer 1

Use pg_query_params() to handle escaping and avoid SQL injection:

$query = pg_query_params(
  $dbconnection,
  'INSERT INTO clients(clientid, name, ipaddress,status) VALUES ($1, $2, $3, $4);', // placeholders
   array($clientid, $name, $ipaddress, $status) // content
);

Answer 2

   Try this
   $query = pg_query($dbconnection,
   "INSERT INTO clients(clientid, name, ipaddress,status) VALUES ('$clientid', '$name', '$ipaddress', '$status' ");

Answer 3

$query = pg_query($dbconnection, "INSERT INTO clients(clientid, name, ipaddress,status) VALUES ('$clientid', '$name', '$ipaddress', '$status')");

should do the work. Note no quotes around the field names and the closing parenthesis after the VALUES .