撇号打破了我在PHP中的mysql查询 [英] apostrophes are breaking my mysql query in PHP

问题描述

我的数据库中的名称记录偶尔包含撇号，例如Joe's Bar，而我刚刚用PHP编写了一个查询脚本，该脚本捕获了该字段并将其粘贴到具有通常$query = "SELECT address FROM restaurants WHERE name='$name'";和撇号的select语句中一些餐厅名称使Love Train脱轨.

My database has name records that occasionally contain apostrophes, such as Joe's Bar and I've just coded a query script in PHP that grabs that field and sticks it into a select statement with the usual $query = "SELECT address FROM restaurants WHERE name='$name'"; and the apostrophe in some of the restaurant names derails the Love Train.

如何避免这种情况发生?

How do I keep this from happening?

旁听答案-使用与通过PHP将其插入数据库时​​所用的相同技术.
反驳-然后我遇到了同样的问题，然后直接使用PHPMyAdmin作弊并输入了麻烦的问题，但这再也不能忽略了.

Snide answer - Use the same technique you used when you inserted them INTO the database via PHP.
Rebuttal - I was having the same problem then and cheated and entered the troublesome ones directly using PHPMyAdmin but this can't be ignored any longer.

感谢您抽出宝贵的时间在假期中回答这个问题.

Thank you for taking the time to answer this during the holidays.

推荐答案

您必须在该行之前$name = mysql_real_escape_string($name);.

您可能还想阅读 SQL注入，因为您的输入显然没有经过验证.

You might also want to read up on SQL Injections, since your inputs are clearly unsanitized.

这篇关于撇号打破了我在PHP中的mysql查询的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！