Question

I was building a portal for my college with posting messages option. Hence I used LONGTEXT to store the message in mysql. But somehow the LONGTEXT doesn t accept the apostrophe mark. It gives following error whenever I post some sentence with apostrophe mark:

"Error: You have an error in your SQL syntax; check the manual that corresponds 
 to your MySQL server version for the right syntax to use near  s open singles
 tournament, will Electrical be able to maintain their dominance o  at line 1"

PS:如果我输入外海标,则不会出现在越狱中,而是在<代码><textarea>。

Answer 1

把它归罪于一边,一刀切。

SELECT  This is a escape   quote test ;

http://www.ohchr.org。

如果你直接从网络形式获取信息并将其纳入数据基,那就是一个巨大的安全风险。这就是卡片的注射方式。

Answer 2

你有两个问题。

You copied the value of the long text into your query (presumably an INSERT or UPDATE statement, though it could simply be the value to compare with in a SELECT).
You did not notice that the first unescaped single quote after the opening quote terminates the string.

鉴于你正在使用我的SQL,我认为你有两个选择:

标准(适用于大多数甚至全部的房舍管理事务):使用两种连续的单一报价插入一个:

                                -- Insert a string consisting of one single quote
  He said, "Don  t do that!"    -- A string containing a single quote

MySQL(也可作为别处的选择,但并非所有的房舍管理处都承认这一选择):使用斜坡来逃避单一报价:
```
                               -- As above
  He said, "Don t do that!"    -- Also as above
```

There may also be functions you can use to do the escaping for you - depending on the host language you are using. However, the preferred way to get values into an SQL statement, especially ones that might contain random characters, is to use placeholders. The mechanics depend on the host language in which you are embedding the SQL, but the general idea is:

The raw SQL string looks like: INSERT INTO SomeTable VALUES(?, ?, ?);
You PREPARE the statement, more or less explicitly.
When you execute it, you provide the data as parameters to the EXECUTE.
Or, if it is a SELECT statement, you PREPARE it, you DECLARE a cursor for it, then you OPEN the cursor and provide the parameter values at that time.

用一种语言(IBM Informix 4GL):

 DEFINE a INTEGER, b DECIMAL(10,2), c VARCHAR(250)

 LET a = 1
 LET b = 99999999.99
 LET c =  He said, "Don  t do that!" 

 PREPARE p1 FROM "INSERT INTO SomeTable(a,b,c) VALUES(?, ?, ?)"
 EXECUTE p1 USING a, b, c

 PREPARE p2 FROM "SELECT * FROM SomeTable WHERE c = ?"
 DECLARE c2 CURSOR FOR p2
 OPEN c2 USING c

请注意,如果您不使用地籍,就必须非常谨慎,不要落到。

Answer 3

2. 利用斜线来逃避扼杀:

Carlito s Ways>

You may need to unescape later, but PHP has a built-in function for that.

insert into customers(firstname, lastname) 
values ( Bill ,  O Connor );

Answer 4

我假定,你需要以抗反弹特性逃避我们的外围(<>条码>),但同时也要提供你为进一步帮助你们而试图实施的“Q”查询。

友情链接