插入前插入單引號

Question

我的php代碼返回一些值，我試圖插入數據庫。

$string = '1,here,Skincare composition against free radicals'; //this is returned 

'(insert into import (S.No,Name,Title)) values ($string)' 

需要將該字符串轉換在適當的格式，以dB插入

'1','here','Skincare composition against free radicals' //This is expected 

破滅應該這樣做？但我不知道如何？

Answer 1

嘗試，

$string = "1,here,Skincare composition against free radicals"; 
$varList = explode(",", $string); 
$newQuery = "INSERT INTO `import` (`S.No`,`Name`,`Title`) VALUES ('" . $varList[0] . "','" . $varList[1] . "','" . $varList[2] . "')"; 

但查詢是SQL Injection脆弱的，請閱讀下面的文章，如何借鑑它來保護，

• How to prevent SQL injection in PHP?

其他來源

• PHP Explode