如何在mysql中处理特殊字符

Question

I have a form that users enter data in and it gets entered into a mysql database. The issue is when they have entered a "%" sign or other special characters it causes problems when my website is trying to display the record. It actually causes nothing to be shown for that record when displaying results. How do I fix this?

$query = "SELECT * FROM makerperk WHERE pid='$pid' LIMIT 1";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
while($row = mysqli_fetch_assoc($result)) {
    $makerid = $row['makerid'];
    $name = $row['name'];
    $title = $row['title'];
    $perkdescription = $row['perkdescription'];
    $image = $row['image'];
    $perktype = $row['perktype'];
    $restrictions = $row['restrictions'];
}

Answer 1

I think you should use PHP mysqli_real_escape_string

/*Escape input variable:*/
$pid = mysqli_real_escape_string($connection, $pid);

/*Run query with escaped string:*/
$query = "SELECT * FROM makerperk WHERE pid='$pid' LIMIT 1";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
while($row = mysqli_fetch_assoc($result)) {
    $makerid = $row['makerid'];
    $name = $row['name'];
    $title = $row['title'];
    $perkdescription = $row['perkdescription'];
    $image = $row['image'];
    $perktype = $row['perktype'];
    $restrictions = $row['restrictions'];
}