mysql - 使用 Ruby 和反斜杠的 SQL 查询

Question

我有这个问题

  db.query("
  UPDATE tm
  SET DESCRIPTION = 'SQL Injection (CALL \'C_DB_FUNCTION\')'
  WHERE DESCRIPTION = 'SQL Injection (CALL \'C DB FUNCTION\')';
  ")

此查询在数据库上运行，但是当我尝试使用 mysql2 gem 通过 ruby​​ 运行它时，出现以下错误，

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'C_DB_FUNCTION')' (Mysql2::Error)

我猜是因为反斜杠，

我该如何逃避或修复它？

谢谢!

Answer 1

特殊字符转义序列请查找 http://dev.mysql.com/doc/refman/5.7/en/string-literals.html#character-escape-sequences

db.query("UPDATE tm SET DESCRIPTION = 'SQL Injection (CALL\\'C_DB_FUNCTION\\')' WHERE DESCRIPTION = 'SQL Injection (CALL\\'C DB FUNCTION\\')'; ")