php - 从 MySQL 检索 mysqli_real_escape_string

Question

// inserting into DB from form

if (!empty($_POST['Title'])) {
    $t = mysqli_real_escape_string($dbc, ($_POST['Title']));
} else {
    $errors[] = 'Please enter a Headline title';
}

// Add the news to the database:

$q = 'INSERT INTO news ( Title, Content) VALUES (?, ?)';
$stmt = mysqli_prepare($dbc, $q);
mysqli_stmt_bind_param($stmt, 'ss', $t, $c);
mysqli_stmt_execute($stmt);

如果 $t 包含撇号，例如

We're awesome

它将把它添加到数据库中

"we\'re awesome"

稍后:

然后如何运行一个查询，其中 title = $t

$q = "SELECT * FROM news WHERE title= '$t'";

查询失败，因为撇号有效地切断了 SQL

SELECT * FROM news WHERE title = ' we're awesome

Answer 1

您可以转义或使用准备好的语句，但不能同时使用!