php到mysql插入脚本中的特殊字符替换

Question

I am sorry if this has been asked before but I'm not understanding most of the stuff I've found using google. 很抱歉，如果以前有人问过这个问题，但我不了解我使用google找到的大多数内容。 I'm just learning how to do this all so please bear with me. 我正在学习如何执行所有操作，因此请耐心等待。

I've created a working "INSERT" php script to insert data into a mysql 5.x database, it works without problem, however the issue i AM having is if the user puts a word with a ' or " into the fields the script spits back a "Error inserting new record" at the user. I need to know how to make the script automatically replace the ' with a \\' before it tries to insert the information to a database. 我已经创建了一个有效的“ INSERT” php脚本，可以将数据插入到mysql 5.x数据库中，它可以正常工作，但是我所遇到的问题是，如果用户在脚本的字段中输入带有“或”的单词我向用户吐出“插入新记录时出错”，我需要知道如何使脚本在尝试将信息插入数据库之前自动将其替换为\\。

What I have at the moment is.... 我现在所拥有的是...

<?php

if (isset($_POST['submitted'])) {

include('../connect/connect-mysql.php');

$Colorist = $_POST['Colorist'];
$Active = $_POST['Active'];

$sqlinsert = "INSERT INTO colorist (Colorist, Active) VALUES ('$Colorist', '$Active')";

if (!mysqli_query($dbcon, $sqlinsert)) {
    die('error inserting new record');
    }//end of nested if statement
$newrecord = "New record added";

} //end of main if


?>
<html>
<head>
</head>
<body>
<form method="post" action="insertcolorist.php">
<input type="hidden" name="submitted" value="true" />
<fieldset>
<legend>New Colorist Data</legend>
<table border="1" width="100%" style="border-collapse: collapse">
<tr><th colspan="2"><font face="Verdana" size="2">Colorist Data</font></th></tr>
<tr><th><font face="Verdana" size="1"><label>Colorist: </label></font></th><td><font size="1" face="Verdana"><input type="text" size="150" name="Colorist" /></font></td></tr>
<tr><th><font face="Verdana" size="1"><label>Is the Colorist Active: </label></font></th><td><font size="1" face="Verdana"><select size="1" name="Active"><option value="">Select...</option><option value="Yes">Yes</option><option value="No">No</option></option></select></font></td></tr>
</table>
</fieldset>
<br>
<input type="submit" value="add new colorist" />
</form>
<?php
echo $newrecord // New record added statement added at the top
?>

Answer 1

There's a mysqli function for cleaning input string. 有一个用于清除输入字符串的mysqli函数。 It's as easy as use 就像使用一样简单

$Colorist = mysqli_real_escape_string($_POST['Colorist']);
$Active = mysqli_real_escape_string($_POST['Active']);

This should be enough for the most common problems of this type 对于这种最常见的问题，这应该足够了

php到mysql插入脚本中的特殊字符替换

问题描述

1 个解决方案

解决方案1
0 2014-03-12 21:18:26

php到mysql插入脚本中的特殊字符替换

问题描述

1 个解决方案

解决方案1 0 2014-03-12 21:18:26

解决方案1
0 2014-03-12 21:18:26