如何防止SQL使用单引号字符存储转义字符

Question

I need to store text strings that will have single quote at beginning and end. I'm issuing JavaScript command from PHP. I'm adding the quotes to the string like this:

echo '<script type="text/javascript">';
echo 'function GetCodes() {';
        echo 'var vlist = document.getElementById("vListOfCodes");';
        echo 'var vcodes = "";';
        echo 'var i;';
        echo 'for (i = 0; i < vlist.length; i++) {';
            echo 'if (i == 0) {';
                echo 'vcodes = vcodes + "\'" + vlist.options[i].value + "\'";';
            echo '}';
            echo 'else {';
                echo 'vcodes = vcodes + ",\'" + vlist.options[i].value + "\'";';
            echo '}';
        echo '}';
        echo 'document.getElementById("vStringOfCodes").value = vcodes;';
    echo '}';
echo '</script>';

When the form is posted and the $_POST['vStringOfCodes'] data saved to SQL SERVER table the backslash character is added along with the single quote, meaning instead of a value in the field of

'mystring',´mystring2',...

i have

\\'mystring\\',\\'mystring2\\',...

How can i prevent those backslashes from being added there?

Answer 1

You can use php native function stripslashes .

$str = "\'mytext\'";
echo stripslashes($str);
//outputs 'mytext'
//in your case
echo stripslashes($_POST['HiddenInput'])

Php function stripslashes