Question

在一个营养餐中,我通常在C内使用印本建造一个MySQL的盘问场。

i.e.

sprintf(sqlcmd,"update foo set dog="lab" where description="%s"",some_desc);
mysql_query(some_conn,sqlcmd);

然而,如果有些_像Crazy 5” Dog,那么MySql服务器会 s,因为它混淆了 d语。

Is it best, within C, to scan some_desc replacing " with "", OR is there a function in MySql to wrap this better... i.e. description=string(Crazy 5" Dog) ?

感谢!

Answer 1

Although MySQL has a mysql_real_escape_string() function, you should probably be using prepared statements instead, which allow you to use ? placeholders instead of real parameters, and then bind them to the real parameters before each execution of the statement.

Answer 2

我SQL确实对你们来说就是这样。

Answer 3

我想写出一个简单的逃脱功能,如:

size_t escape_mysql_string(const char * input, size_t input_size,
   char * output, size_t output_size)
{
   unsigned long ipos; // position within input buffer
   unsigned long opos; // position within output buffer

   // quick check to verify output buffer is at least as large as input buffer
   if (output_size < (input_size+2))
      return(0);

   // loop through input buffer
   opos = 0;
   for(ipos = 0; ((ipos < input_size) && (input[ipos])); ipos++)
   {
      // verify that output buffer has room for escaped input
      if ((opos+2) >= output_size)
      {
         output[opos] =   ;
         return(opos);
      };

      switch(input[ipos])
      {
         // escape ("""), (" "), (""), ("%"), and ("_") characters
         case    :
         case  " :
         case  \ :
         case  % :
         case  _ :
         output[opos] =  \ ;
         opos++;
         output[opos] = input[ipos];
         break;

         // escape newlines
         case  
 :
         output[opos] =  \ ;
         opos++;
         output[opos] =  n ;
         break;

         // escape carriage returns
         case  
 :
         output[opos] =  \ ;
         opos++;
         output[opos] =  r ;
         break;

         // escape tabs
         case  	 :
         output[opos] =  \ ;
         opos++;
         output[opos] =  t ;
         break;

         // save unescapd input character
         default:
         output[opos] = input[ipos];
         break;
      };
      opos++;
   };

   output[opos] =  ;
   return(opos);
}

该呼吁的内容如下:

char some_escaped_desc[1024];
escape_mysql_string(some_desc, strlen(some_desc), some_escaped_desc, 1024);

友情链接