PDO不转义字符串引号 [英] PDO Not escaping string quotes

问题描述

我在php脚本中有一个问题，我使用PDO访问我的数据库。我在PDO中使用 prepare（）或 execute（）时似乎无法让PDO转义我的字符串。我看过所有，我还没有找到一个答案这个问题，因为无处不在，我看看它说PDO自动转义字符串。
这是我的代码：

I have a problem in a php script where I am using PDO to access my database. I can't seem to get PDO to escape my string when I use prepare()or execute()in PDO. I've looked all over and I haven't found an answer to this problem because everywhere I look it says PDO automatically escapes the strings. Here's my code :

$statement = $db->prepare("INSERT INTO Table (ID, Column1, Column2) VALUES (NULL, '$var1', '$var2')");
$query->execute();

让我们接受 $ var1 =abc'def和 $ var2 =123问题是我收到一条错误消息，因为报价没有转义。

Let's admit $var1 = "abc'def" and $var2 = "123" The problem is I get an error message because the quote wasn't escaped.

错误：SQLSTATE [42000]：语法错误或访问冲突：1064您
在您的SQL语法中有错误;检查对应于
的MySQL服务器版本的手册，正确的语法在第1行附近使用'def'，
'123'）'

Error : SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'def', '123')' at line 1

我也尝试使用 query（）方法，但是与引号相同的prpblem。
我真的不明白，这是令人沮丧的。非常感谢您的帮助。

I've also tried using the query() method but same prpblem with the quotes. I really don't understand and it's frustrating. Thanks for any help.

推荐答案

尝试：

# Took out ID, as it should be auto_increment and handled by database
$statement = $db->prepare("INSERT INTO Table (Column1, Column2) VALUES (:col1, :col2)");

$statement->bindValue(':col1', $var1, PDO::PARAM_STR);
$statement->bindValue(':col2', $var2, PDO::PARAM_INT);

$statement->execute();

这篇关于PDO不转义字符串引号的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！