Ajax发布到php的撇号问题

Question

i am posting data with jquery ajax to php but if input has ' inside, data wont be posted. I tried encodeURIComponent but wont work.

any idea on this ?

thanks

EDIT: my code

var name = $("input#name_add").val();
         name = encodeURIComponent(name);

$.post("function.php", { name: name }, function(data) {

                               //codes
                });



$query = "UPDATE `table` SET name = '" . stripslashes($_POST['name']) . "' WHERE ID = '$id'";
$result = mysql_query($query);
if ($result){
print "ok";

}

Answer 1

encodeURIComponent不编码撇号，请尝试以下操作：

encodeURIComponent(str).replace("'", "%27");

Answer 2

Try checking the magic quotes setting on your server with get_magic_quotes_gpc() . If it's on you need to strip_slashes() before using using mysql_real_escape_string() .

Check the get_magic_quotes_gpc() documentation for an example.

Answer 3

If magic_quotes_gpc is off why are you stripping slashes in your query?

Try:

$query = "UPDATE `table` SET name = '" . mysql_real_escape_string($_POST['name']) . "' WHERE ID = '$id'";

If you're using POST you shouldn't need to escape the data before passing it, but by using stripslashes in your code for the mysql you're gonna cause problems with any apostrophes as then your sql won't be escaped.

Answer 4

This is what solved it for me. Since the JavaScript encodeURIComponent() function does not encode apostrophes to %27, I did it myself using my own replaceAll() function.

JS Snippet:

name = encodeURIComponent(name.replaceAll("'", '%27'));

This is the replaceAll() function in my utilities JS file :

String.prototype.replaceAll = function(f, r, no_escape) {
    var rexp = new RegExp(Util.EscapeRegExp(f), 'g');
    if (no_escape) { rexp = new RegExp(f, 'g'); }
    return this.replace(rexp, r);
};

For my purposes, I needed the apostrophe to not be %27 anymore, and the PHP function urldecode() does not do apostrophes either, so I used str_replace() to take care of that.

PHP Snippet :

$name = str_replace('%27', "'", urldecode($_POST['name'] ) );