在MySQL中存储之前进行检查和剥离

Question

I just found out because someone had a ' in their last name and it caused the script to not update anything after that. What's the best way to make their last name safe of any potental damaging characters?

Answer 1

You should probably be using prepared statements if you're embedding the SQL to insert records into the DB in your logic. Among other things they will properly escape data values for you (as long as you use them consistently.)

Answer 2

PHP有一个名为mysql_real_escape_string的函数，它应该清除所有顽皮的字符。

Answer 3

You should use

print htmlentities("O'Brian",ENT_QUOTES);

before inserting into database, it will convert string to

O'Brian

so it is safe to store to database. Keep in mind that this function also escapes double quotes.

More info on escaping string .