如何在php中爲tsql字符串轉義單引號（ms sql）

Question

如何在stuff函數中轉義單引號？我將Microsoft SQL與PHP連接起來。

$hcode = $_GET['hcode']; 
$sql = "SELECT AB.HCode, STUFF(AB.Name1,1,6, '') FROM Article AB WHERE Mandant=1 AND Language= 'EN' AND HCode= '".$hcode."' AND AB.Name1 IS NOT NULL"; 
$result = sqlsrv_query($conn, $sql); 

Answer 1

爲了逃避單引號的MS SQL字符串，我們需要通過添加另一個單引號進行轉義。

以下函數執行此操作。所以，你可以嘗試使用這個功能：

public static function mssql_escape($unsafe_str) 
{ 
    if (get_magic_quotes_gpc()) 
    { 
     $unsafe_str = stripslashes($unsafe_str); 
    } 
    return $escaped_str = str_replace("'", "''", $unsafe_str); 
} 
//for example $unsafe = "AB'CD'EF"; 
$escaped = mssql_escape($unsafe); 
echo $escaped;// Would output the escaped string as "AB''CD''EF"