PHP + MySQL SQL语法错误

Question

我有以下代码

$id_post = mysql_real_escape_string($_POST['id']);
$forumid = (int)mysql_real_escape_string($_POST['forumid']);
$message = mysql_real_escape_string($_POST['message']);

mysql_query("UPDATE forum_reactions SET message = ".$message." WHERE id = ".$id_post." ");

message是TEXT列

它给出了这个错误

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'staat niet in het woordfilter lol WHERE id = 39' at line 1

Answer 1

您没有包含 $message 的字符串，因此 SQL 试图将它们用作关键字，但事实并非如此。试试这个:

$id_post = mysql_real_escape_string($_POST['id']);
$forumid = (int)mysql_real_escape_string($_POST['forumid']);
$message = mysql_real_escape_string($_POST['message']);

mysql_query("UPDATE forum_reactions SET message = '".$message."' WHERE id = ".$id_post." ");

mysql_* 函数已弃用，您应该移至 mysqli_* 或 PDO。

http://php.net/manual/en/function.mysql-query.php

This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. See also MySQL: choosing an API guide and related FAQ for more information. Alternatives to this function include:

mysqli_query() PDO::query()