MySQL database-use of escape functions when querying and inserting data

Recently in a PHP basic video tutorial, when doing a case, when querying user information through the user name, the first use of the escape function to filter the content submitted by the client and then to the SQL statement for subsequent operations. Although the escape function itself can be seen, there are still some doubts.

Confusion: When the data is escaped, the data will be added some backslash, in order to find the corresponding data, then the original existence of the data in the database is also saved to contain a backslash?

Doubt two: After escaping data and then inserting data into the database, will the data stored in the database contain the filtered backslash?

Test the user-submitted form with these questions.

Echo GET_MAGIC_QUOTES_GPC (); Gets the configuration option settings for the current MAGIC_QUOTES_GPC, returns 1 if turned on, otherwise returns 0

　　

$title = $_post[' title '];

$sql = INSERT INTO News (' title ') VALUES (' ". $title. "');

If the mysql_real_escape_string () escape function is not applicable, a SQL error is caused when the received data contains single quotation marks.

　　

$title = mysql_real_escape_string ($_post[' title ');

Escaping and then inserting the data does not occur, and the data inserted into the database is the same as the input, with no backslash added when escaping.

When querying the data, it also compares the contents of the input with the database, and can also query the corresponding results.

From this inference, the mysql_real_escape_string () escape function only protects the SQL statement during execution, and does not affect the result.

Paste the filter function out.

1 functionCheck_input ($value)2 {3     //slash slash removal4     if(GET_MAGIC_QUOTES_GPC())5     {6         $value=stripslashes($value);7     }8     //if it's not a number, enclose it .9     if(!Is_numeric($value))Ten     { One         $value=mysql_real_escape_string($value); A     } -     return $value; -}

　　

The above is their own understanding, to share with you, if wrong also please criticize correct.

　　

MySQL database-use of escaped functions when querying, inserting data