How to use mysql_real_escape_string for an array?

Question

I want to INSERT a set of data submitted by $_POST (in form of array) as

foreach($_POST['data'] as $single) {
$set[]="('static', '$single')";
}
$sets=implode(", ", $set);
mysql_query("INSERT INTO table (Static, Data) VALUES $sets");

Where is the best place to use use mysql_real_escape_string to avoid SQL injection, as the data are submitted by users.

Answer 1

在去你的第一个foreach之前。

$_POST['data'] = array_map("mysql_real_escape_string", $_POST['data']);

Answer 2

Try with this:

foreach($_POST['data'] as $single)
{
    $set[]="('static', mysql_real_escape_string($single))";
}
$sets = implode(", ", $set);
mysql_query("INSERT INTO `table` (`Static`, `Data`) VALUES ".$sets."");