逃脫的UserAgent：$ mysqli-> real_escape_string不起作用

Question

我有這樣的PHP代碼：

$ua = $mysqli->real_escape_string($_SERVER['HTTP_USER_AGENT']); 

$mysqli->query("INSERT INTO browsers(useragent, account, allowed, key, ip) VALUES('$ua', {$userR['id']}, 0, '(Key/token)', '(IP address)')"); 

這是下面的SQL查詢：

INSERT INTO browsers(useragent, account, allowed, key, ip) VALUES('Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.56 Safari/537.17', 8, 0, 'bc132b38f35a01ce', '127.0.0.1') 

不過：即使轉義查詢後確實不行：

#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key, ip) VALUES('Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.17 (KHTML, like' at line 1 

Answer 1

你在你的查詢是使用的是MySQL RESERVED KEYWORD 0，簡單地用反色環繞它`讓數據庫瞭解它是一列

$mysqli->query("INSERT INTO browsers(useragent, account, allowed, `key`, ip) VALUES('$ua', {$userR['id']}, 0, '(Key/token)', '(IP address)')");