PHP mysql_real_escape_string() and % character

Question

mysql_real_escape_string()对% （百分比）字符做了什么以及它代表了多少安全风险（以及如何修复它）？

Answer 1

From the mysql_real_escape_string() documentation :

Note: mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE.

As far as security, unless you are running a LIKE , GRANT , or REVOKE , it's a non-issue. LIKE is probably the only real concern. It's up to you how you would want to escape it in these situations.

A quick example:

"... LIKE '%" . mysql_real_escape_string($string) . "%' ..."

Answer 2

It does not do nothing with % character. Why didn't you try it?

Answer 3

Taken from:

http://php.net/manual/en/function.mysql-real-escape-string.php

Note: mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE.