The difference between Addslashes and mysql_real_escape_string (reprint)

Addslashes and mysql_real_escape_string. are filtered to make the data safe to insert into the database. So what's the difference between these two functions??
Let's take a brief look at it today.
First, we'll start with the PHP manual.
The addslashes escaped characters in the manual are single quotation marks ('), double quotation marks ("), backslash (\) and nul (NULL character).
Mysql_real_escape_string escaped characters are not mentioned. I just said a word.
Note: mysql_real_escape_string () does not escape% and _.
Why does the PHP manual not say that? Because this is actually a MySQL C API. So we need to check the MySQL manual. That's what the above says.
The encoded characters are nul (ASCII 0), ' \ n ', ' \ R ', ' \ ', ' ', ' ', and control-z (see section 9.1, "literal value"). (Strictly speaking, MySQL only needs backslashes and quote characters to refer to the strings in the escaped query.) The function can reference other characters, making them more readable in the log file.

Have to say a word. The above-mentioned MySQL handbook is always confusing.

In order to delve deeper into the differences between these two functions: Or go to see PHP source code it.

This is the PHP addslashes function:

Php_function (addslashes)
{
Zval **str;
if (Zend_num_args ()! = 1 | | zend_get_parameters_ex (1, &str) = = FAILURE) {
Wrong_param_count;
}
CONVERT_TO_STRING_EX (str);
if (z_strlen_pp (str) = = 0) {
Return_empty_string ();
}
Return_string (Php_addslashes (z_strval_pp (str),
Z_STRLEN_PP (str),
&z_strlen_p (Return_value), 0
TSRMLS_CC), 0);
}

It's obvious. It calls the php_addslashes. Let's keep looking at this function.

Phpapi Char *php_addslashes (char *str, int length, int *new_length, int should_free tsrmls_dc)
{
return php_addslashes_ex (str, length, new_length, Should_free, 0 tsrmls_cc);
}

The result is a call to PHP_ADDSLASHES_EX we're like stripping onions. Step-by-step approach to the truth.

Phpapi Char *php_addslashes_ex (char *str, int length, int *new_length, int should_free, int ignore_sybase tsrmls_dc)
{
/* Maximum string length, worst case situation */
Char *new_str;
Char *source, *target;
Char *end;
int local_new_length;

if (!new_length) {
New_length = &local_new_length;
}
if (!STR) {
*new_length = 0;
return str;
}
NEW_STR = (char *) safe_emalloc (2, Length length: (Length = strlen (str))), 1);
Source = str;
End = source + length;
target = NEW_STR;

if (!ignore_sybase && PG (magic_quotes_sybase)) {
while (source < end) {
Switch (*source) {
Case ' + ':
*target++ = ' \ \ ';
*target++ = ' 0 ';
Break
Case ' \ ':
*target++ = ' \ ';
*target++ = ' \ ';
Break
Default
*target++ = *source;
Break
}
source++;
}
} else {
while (source < end) {
Switch (*source) {
Case ' + ':
*target++ = ' \ \ ';
*target++ = ' 0 ';
Break
Case ' \ ':
Case ' \ ':
Case ' \ \ ':
*target++ = ' \ \ ';
/* Break is missing *intentionally* */
Default
*target++ = *source;
Break
}

source++;
}
}

*target = 0;
*new_length = Target-new_str;
if (Should_free) {
Str_free (str);
}
NEW_STR = (char *) erealloc (NEW_STR, *new_length + 1);
return new_str;
}

The above function has very clearly described which characters are escaped. Now let's take a look at mysql_real_escape_string.

This is not in the string.c. is in the MySQL extension.

Php_function (mysql_real_escape_string)
{
Zval *mysql_link = NULL;
Char *str;
Char *new_str;
int id =-1, str_len, New_str_len;
Php_mysql_conn *mysql;
if (Zend_parse_parameters (Zend_num_args () tsrmls_cc, "S|r", &str, &str_len, &mysql_link) = = FAILURE) {
Return
}
if (Zend_num_args () = = 1) {
id = php_mysql_get_default_link (internal_function_param_passthru);
Check_link (ID);
}
Zend_fetch_resource2 (MySQL, Php_mysql_conn *, &mysql_link, id, "Mysql-link", Le_link, Le_plink);
New_str = Safe_emalloc (Str_len, 2, 1);
New_str_len = mysql_real_escape_string (&mysql->conn, New_str, str, str_len);
New_str = Erealloc (new_str, New_str_len + 1);
Return_stringl (new_str, New_str_len, 0);
}

This function does not peel the onion as above.

Instead, it calls the MySQL C api.mysql_real_escape_string () directly.

It is important to note that this function is called before mysql_real_escape_string this API. First determine if the database is connected

Check_link (ID); That's the word.

So this means that mysql_real_escape_string must be connected to the database before it can be used. To confirm this point.
Let's take a simple experiment.

<?php
Echo mysql_real_escape_string ("FDSAFDA ' Fdsa");

Results
Warning:mysql_real_escape_string () [function.mysql-real-escape-string]: Access denied for user ' ODBC ' @ ' localhost ' ( Using Password:no) in PHPDocument1 on line 2

Warning:mysql_real_escape_string () [function.mysql-real-escape-string]: A link to the server could not being established in PHPDocument1 on line 2

Sure enough, the error. Show no links on the database:

All right.. The summary is the first.

We finally understand why so many open-source programs such as Discuz with addslashes instead of mysql_real_escape_string.

So it's good to use addslashes in the future. You can forget about mysql_real_escape_string for the time being.

The difference between Addslashes and mysql_real_escape_string (reprint)