PHP mysqli_real_escape_string（）在函数内部不起作用

Question

I have a function that adds a log entry to my database as follows:

function doLog($conn, $category, $result, $details){
    $category = mysqli_real_escape_string($conn, $category);
    $result = mysqli_real_escape_string($conn, $result);
    $details = mysqli_real_escape_string($conn, $details);

    mysqli_query($conn, "INSERT INTO log (category, result, details) VALUES('$category', '$result', '$details')");
    return $details; //for debug
}

echo doLog2($conn, "Test", "Test", "A 'test' entry"); //echo is for debug

A 'test' entry is returned/echoed as A \\'test\\' entry , but is inserted into my database without the slashes.

How can this be?

Answer 1

This is working correctly. The backslashes are to escape the quotes in the SQL query, so that the quote characters are inserted verbatim. It's not supposed to also insert the escape character \\ .

If you had applied escaping twice, you'd end up with an escaped backslash followed by an escaped quote like this:

A \\\'test\\\' entry

What would be stored in the database would be:

A \'test\' entry

All this is much simpler if you use parameterized statements. You don't do any quoting or escaping.

function doLog($conn, $category, $result, $details){
    $sql = "INSERT INTO log (category, result, details) VALUES (?, ?, ?)";
    $stmt = mysqli_prepare($conn, $sql);
    mysqli_stmt_bind_param($stmt, "sss", $category, $result, $details);
    mysqli_stmt_execute($stmt);

    return $details; //for debug
}