在MySQL查詢中使用特殊字符拋出異常

Question

這是mysqlquery

SELECT course_id 
FROM course_master 
WHERE year_id = '6' 
AND course_name = ''What is Test?': Perspectives' 

當我運行查詢，它拋出，因爲特殊字符的語法錯誤problem.Iam使用函數mysql_escape_string逃跑，但它不working.How到轉義這些字符

Answer 1

當執行一個查詢並且一個值有單引號時，加倍單引號所以不會出錯。

SELECT course_id 
FROM course_master 
WHERE year_id = '6' 
AND course_name = '''What is Test?'': Perspectives' 

但是如果你在PHP上這樣做，請使用PreparedStatement。這也會阻止從SQL Injection。下面的文章將告訴你如何使用PHP Extensions.

• How to prevent SQL injection in PHP?

Answer 2

嘗試此查詢 -

SELECT course_id 
FROM course_master 
WHERE year_id = 6 
AND course_name = '''What is Test?'': Perspectives' 

或使用轉義 -

SELECT course_id 
FROM course_master 
WHERE year_id = 6 
AND course_name = '\'What is Test?\': Perspectives' 

Answer 3

我使用mysql_esca pe_string來逃脫，但它不工作。

您錯了。你只需要格式化字符串值，而不是整個查詢

// here are your variables 
$year = 6; 
$name = "'What is Test?': Perspectives"; 

// let's format them 
$year = intval($year); 
$name = mysql_real_escape_string($name); 

// and then insert in a query 
$sql = "SELECT course_id FROM course_master 
     WHERE year_id = $year AND course_name = '$name'";