使用 PHP/SQL 将带有逗号 (,) 的值插入到数据库中

Question

I am trying to insert values with a comma into a database but the comma is splitting the query so that the part of the string before the comma goes into the correct column, while the bit after the comma goes into the next and every item in the query after that is displaced into the next column.

My connection file to my db is as follows:

define('DB_HOST', 'localhost');
define('DB_NAME', '********');
define('DB_USER', '********');
define('DB_PASS', '********');
define('DB_CHAR', 'utf8');

class DB
{
    protected static $instance = null;
    protected function __construct() {}
    protected function __clone() {}

    public static function instance(){
        if (self::$instance === null){
            $opt  = array(
                PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
                PDO::ATTR_EMULATE_PREPARES => FALSE,
            );
            $dsn = 'mysql:host='.DB_HOST.';dbname='.DB_NAME.';charset='.DB_CHAR;
            self::$instance = new PDO($dsn, DB_USER, DB_PASS, $opt);
        }
        return self::$instance;
    }

    public static function __callStatic($method, $args){
        return call_user_func_array(array(self::instance(), $method), $args);
    }

    public static function run($sql, $args = []){
        if (!$args){
            return self::instance()->query($sql);
        }
        $stmt = self::instance()->prepare($sql);
        $stmt->execute($args);
        return $stmt;
    }
}

And then I do my query like this:

$item1 = 'item1';
$item2 = 'item_with_a_,_symbol';
$item3 = 'item3';

$params = [$item1,$item2,$item3];
$sql = "INSERT INTO table (col1,col2,col3) VALUES(?,?,?)";
$stmt = DB::run($sql,$params);

In this case my database would be like so:

col1            col2            col3
item1           item_with_a_    _symbol

What is the best way to get around this?

Answer 1

Try escaping the input before running the insert.mysqli_real_escape_string() should do the trick

Check this entry in the PHP manual for reference