mysql - 理解 mysql_real_escape_string();

Question

我不明白为什么 mysql_real_escape_string 需要转义换行符和回车符:

\n 和 \r

使用 \n 和 \r 的 SQL 中可能存在哪些安全漏洞？

UPDATE tbl SET field = 'text text text \n text text text \r text text' WHERE id = 1;

Answer 1

MySQL 不要求转义换行符。 manual page for the mysql_real_escape_string function of MySQL’s C API说:

Characters encoded are “\”, “'”, “"”, NUL (ASCII 0), “\n”, “\r”, and Control+Z. Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. mysql_real_escape_string() quotes the other characters to make them easier to read in log files.