PHP simplest SQL anti-injection function and method _php tutorial

The MySQL tutorial _real_escape_string-escapes special characters in strings used in SQL statements, and takes into account the current character set of the connection.

Note, however, that the function does not escape% and _. In addition, it is best not to use the function for the entire SQL statement, but to escape only the string parameters of the incoming SQL statement, otherwise unexpected results will occur.

$item = "Zak s and Derick ' s Laptop";
$escaped _item = mysql_real_escape_string ($item);
printf ("Escaped string:%sn", $escaped _item);
?>

The Addslashes () function adds a backslash before the specified predefined character.

These predefined characters are:

Single quotation mark (')
Double quotation marks (")
Back slash ()
Null

By default, PHP instruction MAGIC_QUOTES_GPC is on, and automatically runs Addslashes () for all GET, POST, and COOKIE data. Do not use Addslashes () for strings that have been MAGIC_QUOTES_GPC escaped, because this results in double-layer escaping. You can use the function GET_MAGIC_QUOTES_GPC () to detect this situation.

$str = "Jane & ' Tarzan '"; Defining HTML strings
echo Html_entity_decode ($STR); Output the converted Content
echo "
";
Echo Html_entity_decode ($str, ent_quotes); Content with optional parameter output

For more detailed information, please see: http://www.bKjia.c0m/phper/php-function/36439.htm

http://www.bkjia.com/PHPjc/629708.html www.bkjia.com true http://www.bkjia.com/PHPjc/629708.html techarticle The MySQL tutorial _real_escape_string escapes special characters in strings used in SQL statements, and takes into account the current character set of the connection. Note, however, that the function does not escape% and _. In addition ...

