English 中文(简体)
mysql_real_escape_string()不应该在数据库中保留斜杠吗?
原标题:
  • 时间:2008-11-10 10:43:48
  •  标签:

Im using smarty and mysql_real_escape_string() for user input, and when I insert some code with or " , and lookup in phpmyadmin it shows without backslashes.

When I get record from DB i doesn t have backslashes also. But when I just pass escaped string without inserting into the db it is backslashed.

Shouldn t it add slashes, insert with them and then I would strip them when i would output? Or am I missing something?

最佳回答

你没有注意到 - 用反斜杠转义是为了确保查询不会出现格式错误,比如这样的查询肯定会出错,可能还会有SQL注入的风险。

insert into table values ( whatever  this  is )

什么都不会保存在表中,而这个:

insert into table values ( whatever  this  is )

将“无论是什么”这个值保存在表中。

问题回答

暂无回答




相关问题
热门标签