轉義和字符串？

Question

人們對我上一個問題的建議似乎沒有幫助。 因此，我想到了再次在完整代碼中發布它：mysql_depricated.php：

<script>
 function fun()
 {
 var ajaxRequest;  // The variable that makes Ajax possible!

    try{
        // Opera 8.0+, Firefox, Safari
        ajaxRequest = new XMLHttpRequest();
    } catch (e){
        // Internet Explorer Browsers
        try{
            ajaxRequest = new ActiveXObject("Msxml2.XMLHTTP");
        } catch (e) {
            try{
                ajaxRequest = new ActiveXObject("Microsoft.XMLHTTP");
            } catch (e){
                // Something went wrong
                alert("Your browser broke!");
                return false;
            }
        }
    }

   var name = document.getElementById("name").value;
   var url = "mysql_depricated2.php";
   var param = "name=" + name;

   ajaxRequest.open("POST", url, true);

//Send the proper header information along with the request
ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
ajaxRequest.setRequestHeader("Content-length", param.length);
ajaxRequest.setRequestHeader("Connection", "close");

    ajaxRequest.send(param); 
 }
</script>

 <input type="text" id="name">
 <input type="button" value="ajax&" onclick="fun()">

mysql_depricated2：

<?php
      $host="localhost"; // Host name
      $username="root"; // Mysql username
      $password=""; // Mysql password
      $db_name="example"; // Database name

   // Connect to server and select databse.
   $con=mysql_connect("$host", "$username", "$password")or die("cannot connect");
   mysql_select_db("$db_name")or die("cannot select DB");


 $content = $_POST['name'];
 $content=mysql_real_escape_string($content);

 $sql = "insert into e values('$content')";
 mysql_query($sql);
?>

如果我嘗試插入包含＆符號的字符串，它將不起作用。 有什么解決辦法嗎？

Answer 1

替換以下行：

ajaxRequest.send(param);

為此：

ajaxRequest.send( encodeURIComponent(param) );

因此，您將&特殊字符編碼為其%26 url編碼形式。