mysql_real_escape_string（$值）不工作

Question

IM試圖防止SQL注入與

mysql_real_escape_string($value) 

這裏是我的代碼，但它似乎是我得到一個空值，

$this->name_safe = mysqli_real_escape_string($this->name,$this->link); 

      $this->query = "INSERT INTO student (complete_name, date_birth, gender, email, student_status) 
      VALUES ('$this->name_safe', '$this->date', '$this->gender', '$this->email_1', 'current')"; 

？ thx

Answer 1

你有你的函數參數錯誤的順序。數據庫鏈接首先，然後字符串轉義。

http://php.net/mysqli_real_escape_string

mysqli_real_escape_string($this->link, $this->name)