Question

我是PDO新来的, 弄得一团乱,

任何人都可以帮忙, 这是我的代码

if(!empty($_POST) && isset($_POST)) { 

include ( connection_pdo.php );

$dbh = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);

$source_url= mysql_real_escape_string($_POST[ source_url ]);
$class     = mysql_real_escape_string($_POST[ class ]);
$year      = mysql_real_escape_string($_POST[ year ]);
$date      = time();
$ip        = $_SERVER[ REMOTE_ADDR ];

$insert = $dbh->prepare("
  INSERT IGNORE INTO school_students_images
            ( folder_name,  image_url,  source_url,  class, year , date , ip )
    VALUES  (:folder_name, :image_url, :source_url, :class, :year, :date, :ip)
");

$a=0;
while ($a<1000){
$a++;
$insert->execute(array(
             folder_name => $name->content, //** geting from other source
             image_url   => $link[$a], //** geting from other source
             source_url  => $source_url,
             class       => $class ,
             year        => $year ,
             date        => $date,
             ip          => $ip
            ));
}

它不工作得到错误,但如果我用它

    $source_url= ($_POST[ source_url ]);
    $class     = ($_POST[ class ]);
    $year      = ($_POST[ year ]);
    $date      = time();
    $ip        = $_SERVER[ REMOTE_ADDR ];

it is working ... so i am confused is it safe to POST without mysql_real_escape_string into database? (is PDO giving any security by default ?) or i am doing some mistake in this... please help

Answer 1

是的, PDO 自动跳出您的数据, 所以您不需要使用 < code> mysql_ real_ escape_string 。见 < a href=" https:// stackoverflow.com/ questions/1742066/ why- is- pdo- better- for- escaping- mysql- queries- querystrings- than- mysql- real- escape" 。 (例如) >这里 < a > 。

Answer 2

mysql_real_escape_string 需要通过 mysql 连接到一个通过 mysql_connect 连接到的主动 连接... 因此,是的,它不会起作用。



无论如何,PDO 自动为您执行PDO

Answer 3

预先准备好的语句无需逃避变量。驱动程序会自动为您做, 取决于您在下面使用的数据库。事实上, 您必须自己去回避它, 因为这会加倍逃跑。

友情链接