问题描述

好的，所以我更新数据库表的代码具有以下不同的风格:

Alright, so my code to update my database tables is varying flavours of the following:

$query = "
  insert into Comment 
    (Comment, CommentDate, Rating, UserRid) 
  values 
    (:comment, now(), 0, :userrid )" ;

try {           
  $db_conn = new PDO('mysql:host='.$db_server.';dbname='.$db_name, $db_username, $db_password );

  $db_conn->beginTransaction();
  $prep = $db_conn->prepare($query);
  $prep->bindParam(':comment', $comment, PDO::PARAM_STR, 500);
  $prep->bindParam(':userrid', $userrid, PDO::PARAM_INT, 20);
  $prep->execute();

  $db_conn->commit();
} catch (PDOException $e)  {
  $db_conn.rollBack();
  echo "Error!: " . $e->getMessage() . "<br/>";
  die();
}

在上面，评论来自另一个页面的帖子.正在通过函数调用正确设置用户 ID.一切正常，除了斜线被添加到表格中.

In the above, comment comes in via Post from another page. Userrid is being set properly via a function call. Everything works properly, except the slashes get added to the table.

我读过的所有内容都说，为了在有人输入撇号时避免使用斜杠，我应该使用参数化查询.如果我没记错的话，我很确定这就是我正在做的.我错过了什么吗?有人可以让我知道我做错了什么吗?

Everything I've read says that in order to get around having slashes whenever someone types in an apostrophe that I should be using parameterized queries. If I'm not mistaken, I'm pretty sure that's what I'm doing. Am I missing something? Can anybody let me know what I'm not doing right?

提前致谢，迈克尔

推荐答案

可能你已经magic_quotes_gpc() 开启，你需要做这样的事情:

Probably ou've magic_quotes_gpc() turned on, you need to do something like this:

if (get_magic_quotes_gpc() == true)
{
    $comment = stripslashes($comment);
    $userrid = stripslashes($userrid);
}

如果您使用的是 PHP 5.3+，您可以通过将以下代码行放在文件顶部来摆脱所有魔术引用的变量:

If you're using PHP 5.3+ you can get rid of all magic quoted variables by placing the following lines of code on the top of your file:

if (get_magic_quotes_gpc() === 1)
{
    $_GET = json_decode(stripslashes(json_encode($_GET, JSON_HEX_APOS)), true);
    $_POST = json_decode(stripslashes(json_encode($_POST, JSON_HEX_APOS)), true);
    $_COOKIE = json_decode(stripslashes(json_encode($_COOKIE, JSON_HEX_APOS)), true);
    $_REQUEST = json_decode(stripslashes(json_encode($_REQUEST, JSON_HEX_APOS)), true);
}

如果您运行的是较低版本的 PHP，您应该采取看看这个页面.

If you're running a lower version of PHP you should take a look at this page.

这篇关于MySQL 表中的斜线，但使用 PDO 和参数化查询.这是怎么回事?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！