PHP：轉義字符不起作用

Question

每當我嘗試脫離O'Neil中的單引號時，編輯器的行爲就好像它不工作（基於它使用的顏色編碼），當我運行它時它也不起作用。

$query="UPDATE `users` SET `name` = 'Ian O\'Neil' WHERE id = 2 "; 
mysqli_query($link, $query); 

Answer 1

我測試如下其工作，請檢查：

$link = new mysqli("localhost", "username", "password", "database"); 

/* check connection */ 
if ($link->connect_errno) { 
    printf("Connect failed: %s\n", $link->connect_error); 
    exit(); 
} 

$query="UPDATE `users` SET `name` = 'Ian O\'Neil' WHERE id = 2 "; 
mysqli_query($link, $query); 

Answer 2

我得到一個很好的資源來回答你的問題。 消息人士表示，你應該使用

mysqli_real_escape_string從源頭功能 例如：

<?php 
$link = mysqli_connect("localhost", "my_user", "my_password", "world"); 

/* check connection */ 
if (mysqli_connect_errno()) { 
    printf("Connect failed: %s\n", mysqli_connect_error()); 
    exit(); 
} 

mysqli_query($link, "CREATE TEMPORARY TABLE myCity LIKE City"); 

$city = "'s Hertogenbosch"; 

/* this query will fail, cause we didn't escape $city */ 
if (!mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) { 
    printf("Error: %s\n", mysqli_sqlstate($link)); 
} 

$city = mysqli_real_escape_string($link, $city); 

/* this query with escaped $city will work */ 
if (mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) { 
    printf("%d Row inserted.\n", mysqli_affected_rows($link)); 
} 

mysqli_close($link); 
?> 

這是源： http://php.net/manual/en/mysqli.real-escape-string.php

您可能需要閱讀它。

謝謝我希望這可以幫助