MySQLi
PHP Manual

mysqli::real_escape_string

mysqli_real_escape_string

(PHP 5)

mysqli::real_escape_string -- mysqli_real_escape_stringEscapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection

Açıklama

Object oriented style (both methods are equivalent):

string mysqli::escape_string ( string $escapestr )
string mysqli::real_escape_string ( string $escapestr )

Procedural style:

string mysqli_real_escape_string ( mysqli $link , string $escapestr )

This function is used to create a legal SQL string that you can use in an SQL statement. The given string is encoded to an escaped SQL string, taking into account the current character set of the connection.

Değiştirgeler

bağlantı

Sadece yordamsal tarz: mysqli_connect() veya mysqli_init() işlevinden dönen bir bağlantı tanıtıcısı.

escapestr

The string to be escaped.

Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", and Control-Z.

Dönen Değerler

Returns an escaped string.

Örnekler

Örnek 1 Object oriented style

<?php
$mysqli 
= new mysqli("localhost""my_user""my_password""world");

/* check connection */
if (mysqli_connect_errno()) {
    
printf("Connect failed: %s\n"mysqli_connect_error());
    exit();
}

$mysqli->query("CREATE TEMPORARY TABLE myCity LIKE City");

$city "'s Hertogenbosch";

/* this query will fail, cause we didn't escape $city */
if (!$mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) {
    
printf("Error: %s\n"$mysqli->sqlstate);
}

$city $mysqli->real_escape_string($city);

/* this query with escaped $city will work */
if ($mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) {
    
printf("%d Row inserted.\n"$mysqli->affected_rows);
}

$mysqli->close();
?>

Örnek 2 Procedural style

<?php
$link 
mysqli_connect("localhost""my_user""my_password""world");

/* check connection */
if (mysqli_connect_errno()) {
    
printf("Connect failed: %s\n"mysqli_connect_error());
    exit();
}

mysqli_query($link"CREATE TEMPORARY TABLE myCity LIKE City");

$city "'s Hertogenbosch";

/* this query will fail, cause we didn't escape $city */
if (!mysqli_query($link"INSERT into myCity (Name) VALUES ('$city')")) {
    
printf("Error: %s\n"mysqli_sqlstate($link));
}

$city mysqli_real_escape_string($link$city);

/* this query with escaped $city will work */
if (mysqli_query($link"INSERT into myCity (Name) VALUES ('$city')")) {
    
printf("%d Row inserted.\n"mysqli_affected_rows($link));
}

mysqli_close($link);
?>

Yukarıdaki örneğin çıktısı:

Error: 42000
1 Row inserted.

Ayrıca Bakınız


MySQLi
PHP Manual