php - 今天，mysql_real_escape_string() 正在转义单引号和双引号

Question

$str = 'BEGIN This is a "quote" test. \'Single\' END';
echo $str . "\n";
echo mysql_real_escape_string($str);

// Outputs:
BEGIN This is a "quote" test. 'Single' END
BEGIN This is a \"quote\" test. \'Single\' END

在 CentOS 上运行 PHP 5.3.2。据我所知，mysql_real_escape_string() 只会转义单引号以防止 sql 注入(inject)。双引号与此无关，因为 " 不会在 MySQL 中开始或结束字符串文字!

这导致反斜杠被插入到数据中!我显然不想要的东西。

Answer 1

" 确实在 MySQL 中开始一个字符串。(参见:Strings)

异常(exception):

If the ANSI_QUOTES SQL mode is enabled, string literals can be quoted only within single quotation marks because a string quoted within double quotation marks is interpreted as an identifier.