php - mysql_real_escape_stringおよび'

Question

score 16 · Accepted Answer

The character ’ is not getting missed, it is simply a character that is not used by mysql for encasing strings, and does not need to be escaped.

The reason it is turning into that strange string is because it is a multi-byte character, and you are putting it into a single byte field.

score 4 · Accepted Answer

You should be using prepared statements with bind variables instead: http://php.net/manual/en/pdo.prepared-statements.php This way you don't have to worry about escaping anything. The advantages are mentioned in the documentation I linked to.

score 2 · Accepted Answer

mysql_real_escape_string() simply escapes a handful of characters (using \'s) to make them "safe" to shove into your query. You appear to have an encoding mismatch with your data (the styled quote) and your column encoding type. mysql_real_escape_string will never resolve that kind of issue.

score 1 · Accepted Answer

Is that a fancy quote? If so, it probably looks like gibberish in your database due to character encoding differences. Each table has an associated character encoding, and the connection has its own encoding.

Try executing "SET NAMES utf8" before your query. That will set the encoding of the connection to UTF-8. Of course, if you are trying to store UTF-8 characters into, say a latin1 table, you will still not get the result you expect.

score 0 · Accepted Answer

これは、UTFエンコーディングを使用する必要がある特殊文字です。

データベースにデータを挿入するページの上部にこの行を配置します

header ('Content-type: text/html; charset=utf-8');

それがうまくいくことを願っています

score 0 · Accepted Answer

It will work in case you had established the mysql connection with: mysql_query ("SET NAMES 'utf8'");

In other words, if SET NAMES 'utf8' is not set, utf8_encode is not needed.

score -1 · Accepted Answer

-1

mysql_real_escape_string(utf8_encode($data));

Hope this will work.

于 2011-02-06T03:28:26.060 に答える

score -1 · Accepted Answer

What would even be better is to use PDO instead of standard mysql.

http://www.php.net/manual/en/class.pdo.php

score -1 · Accepted Answer

<?php
    if(isset($_GET['submit']))
    {
        mysql_connect('localhost','root','');
        mysql_select_db('test');
        $var=mysql_real_escape_string($_GET['asd']);
        $sql="INSERT INTO `test`.`asd` (`id` ,`name` ,`desc`)VALUES ('', '$var', 'knkk');";
        echo $sql."<br />";
        $res=mysql_query($sql) or die('error');
        echo $res;
    }
?>

<html>
<body>
    <form name="f1" method="get">
        <input type="text" name="asd">
        <input type="submit" name="submit">
    </form>
</body>
</html>

Output:

INSERT INTO test.asd (id ,name ,desc)VALUES ('', 'asd\'lgh', 'knkk');

1

enter image description here

php - mysql_real_escape_stringおよび'

9 に答える 9

Related

Reference