php - 在 php 中使用一个字符串到 mysql 数据库中

Question

我正在使用 PHP 获取一个字符串，然后尝试将其放入我的数据库 (mySql)。我不断收到错误

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'material )' at line 1.

这是我的代码。我用 php 打印了声明，这是正确的。

$description=$_POST["textField4"];

$description= addslashes($description);//found these two line using google
$description = mysql_real_escape_string($description);//neither seem to help.


$sql="INSERT INTO budget8000 (categories,subCategory, amount, date, description)
VALUES ($category,$subCategory, $amount, curdate(), $description )";

Answer 1

正确的做法是:

$description=mysql_real_escape_string($_POST["textField4"]);
...
//and so on for each an every field that you $_GET or $_POST.

$sql= "INSERT INTO budget8000 (categories,subCategory, amount, date, description)
VALUES ('$category','$subCategory', '$amount', curdate(), '$description' )";
//      ^         ^ these quotes are vital to prevent SQL-injection and errors.
// without them mysql_real_escape_string will not work!

参见:How does the SQL injection from the "Bobby Tables" XKCD comic work?