如何转义要插入mysql的HTML代码

Question

I am using tinymce editor to have html page and then insert it in mysql. I tried this:

 $esdata = mysql_real_escape_string($data);

it is working for all html except images. If I have hyperlink like:

http://www.abc.com/pic.jpg

then it makes it somewhat very obscure and the image doesn't appear.

INPUT <img src="../images/size-chart.jpg" alt="Beer" />

OUPUT <img src="\\&quot;&quot;images/size-chart.jpg\\\\&quot;\\&quot;" alt="\\&quot;Beer" /> <img src="\\&quot;&quot;images/size-chart.jpg\\\\&quot;\\&quot;" alt="\\&quot;Beer" />

Answer 1

Try to use urlencode and urldecode to escape the string. As Christian said it is not used for the sake of DB but to keep the things as it is. So you can also use urlencode and urldecode .

For Ex:

//to encode
$output = urlencode($input);


//to decode
$input = urldecode($output);

Answer 2

You shouldn't over-escape code before you send it to DB.

When you escape it, it's done in a way that it is stored in the DB as it was originally. Escaping is not done for the sake of the DB, but for the sake of keeping the data as it was without allowing users to inject bad stuff in your sql statements (prior to sending the stuff in the DB).

Answer 3

您应该使用用htmlspecialchars函数来编码字符串， htmlspecialchars_decode显示的字符串返回HTML