Question

这使我陷入困境。当我试图将某个东西保存到数据库中包含一个代号( ) 的数据库时, 它会一直保存到那时, 在那之后它不会保存。例如 :

说我想保存这个消息:报告详述了蒂姆·库克在苹果店的变动,

它节省:报告细节Tim Cook

它保存到数据库罚款,但只有所有之前

我的代码:

if(isset($_POST[ submit ]))
{
global $db, $db_table_prefix;


$origRLTitle = $_POST[ RLTitle ];
$origRLURL = $_POST[ RLURL ];
$origRLUserID = $_POST[ user-id ];

$RLTitle = mysql_real_escape_string($origRLTitle);
$RLURL = mysql_real_escape_string($origRLURL);
$RLUserID = mysql_real_escape_string($origRLUserID);    


if(strlen($RLTitle)>0 && strlen($RLURL)>0 && strlen($RLUserID)>0)
{
mysql_connect($db_host, $db_user, $db_pass) or die(mysql_error());
mysql_select_db("sf") or die(mysql_error());
mysql_query("INSERT  INTO `ReadLater` (Title, URL, User_ID) VALUES ( ".$RLTitle." ,  ".$RLURL." ,  ".$RLUserID." )");
echo "Saved";
}
}

我尝试过我的sql_real_escape_string,但(如果我正确使用)似乎行不通。

次要注意:确保上述形式免受攻击的最佳途径是什么?

也是为了 " 。

Answer 1

您需要调用 mysql_ real_ escape_string > () 后连接到您的数据库 :

if(isset($_POST[ submit ]))
{
    global $db, $db_table_prefix;


    $origRLTitle = $_POST[ RLTitle ];
    $origRLURL = $_POST[ RLURL ];
    $origRLUserID = $_POST[ user-id ];
    mysql_connect($db_host, $db_user, $db_pass) or die(mysql_error());
    mysql_select_db("sf") or die(mysql_error());

    $RLTitle = mysql_real_escape_string($origRLTitle);
    $RLURL = mysql_real_escape_string($origRLURL);
    $RLUserID = mysql_real_escape_string($origRLUserID);    


    if(strlen($RLTitle)>0 && strlen($RLURL)>0 && strlen($RLUserID)>0)
    {
        mysql_query("INSERT  INTO `ReadLater` (Title, URL, User_ID) VALUES ( ".$RLTitle." ,  ".$RLURL." ,  ".$RLUserID." )");
        echo "Saved";
    }
}

Answer 2

变动变动

mysql_query("INSERT  INTO `ReadLater` (Title, URL, User_ID) VALUES ( ".$RLTitle." ,  ".$RLURL." ,  ".$RLUserID." )");

至

$query = "INSERT  INTO `ReadLater` (Title, URL, User_ID) VALUES ( ".$RLTitle." ,  ".$RLURL." ,  ".$RLUserID." )";
echo $query;
mysql_query($query);

And check out the actual query you are sending, easy 至 spot the problems then :)

友情链接