The PHP submission form contains single quotes, and MySQL encounters the wrong solution when it executes.

First look at the problem.

"INSERT into Tg_article (
Tg_username,
Tg_type,
Tg_title,
Tg_content,
Tg_date
)
VALUES (
' {$_clean[' username '} ',
' {$_clean[' type '} ',
' {$_clean[' title '} ',
' {$_clean[' content '} ',
Now ()
)
"

People will find that the party to submit the content and the single quotation mark, value is inside the single quotation mark, this is a clear error, this is also in the development of Web site often encountered and easy to ignore the problem. Let's talk about how to solve it.

1. In the case of Magic_quotes_gpc=on,

We can not make the string data of the input and output database

Addslashes () and Stripslashes (), the data will also be displayed normally.
If you do a addslashes () processing of the input data at this time,
Then you must use Stripslashes () to remove the extra backslash when outputting.
2. In the case of Magic_quotes_gpc=off
The input data must be processed using addslashes (), but does not require the use of stripslashes () to format the output
Because Addslashes () did not write the backslash to the database, it only helped MySQL complete the execution of the SQL statement.

Creates an escape function and escapes the content

function _mysql_string ($_string) {    //GET_MAGIC_QUOTES_GPC () If the open state is not escaped, otherwise Z escape  //  if (! GPC) {       //return @mysql_escape_string ($_string);   }else{         //return $_string;    if (GPC) {        if (Is_array ($_string)) {            foreach ($_string as $_key=>$_value) {                $_string[$_key] = _ Mysql_string ($_value);                $_string[$_key] = addslashes ($_string[$_key]);            }        } else{            $_string = @mysql_real_escape_string ($_string);        }    }              return $_string;}

Accept content        $_clean = Array ();        $_clean[' username '] = $_cookie[' username '];        $_clean[' type '] = $_post[' type ');        $_clean[' title '] = $_post[' title '];        $_clean[' content ' = $_post[' content '];        _mysql_string ($_clean);

The PHP submission form contains single quotes, and MySQL encounters the wrong solution when it executes.