mysql_real_escape_string转义单引号到MYSQL条目

Question

I enter this into my form field: O'mally

I run this code on the text:

foreach($_POST as $key=>$value){
    $form[$key] = mysql_real_escape_string($value); //Escape input.
}

The POST output is: O'mally

The output of the $form variable after running the code listed above is: O\\'mally

The query is:

mysql_query("insert into tbl_test 
                (lastName) 
                values 
                ('{$form['lastName']}')")

The database gets O\\'mally inserted into it (I want O'mally to be inserted, not WITH the escape).

What am I doing wrong here?

I have confirmed that magic quotes is OFF via phpinfo() . Thanks.

Answer 1

当您需要将O'mally从数据库输出到浏览器时，只需使用stripslashes（）函数。