mysql 真实转义字符串错误

Question

代码:

mysql_query("INSERT INTO Account(User,
Pw, email)
VALUES('mysql_real_escape_string($_POST[user])',
'$pw','mysql_real_escape_string($_POST[email])
) ")  or die(mysql_error());

错误:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''mysql_real_escape_string(123) )' at line 1

请帮忙

Answer 1

问题是您引用了 PHP 命令，因此它永远不会传递给 PHP

试试这个

mysql_query("INSERT INTO Account(User, Pw, email) VALUES('".mysql_real_escape_string($_POST[user])."', '$pw','".mysql_real_escape_string($_POST[email])."' ) ") or die(mysql_error());

但是如果 user 不是定义的常量，您的 $_POST[user] 调用也可能会失败，所以也许可以尝试这个

mysql_query("INSERT INTO Account(User, Pw, email) VALUES('".mysql_real_escape_string($_POST['user'])."', '$pw','".mysql_real_escape_string($_POST['email'])."' ) ") or die(mysql_error());