php - mysql_real_escape_string() 发生限制查看谷歌地图

Question

我粘贴谷歌地图代码

<iframe width="186" height="186" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="http://maps.google.com/maps?f=d&source=s_d&saddr=NIPA,+Karachi,+Pakistan&daddr=&hl=en&geocode=FXg3fAEd6dH_AyF_rsIkOA6mpg&aq=&sll=24.91788,67.097065&sspn=0.007414,0.009645&vpsrc=0&mra=ls&ie=UTF8&t=m&ll=24.91788,67.097065&spn=0.007414,0.009645&output=embed"></iframe>
<br />
<small><a href="http://maps.google.com/maps?f=d&source=embed&saddr=NIPA,+Karachi,+Pakistan&daddr=&hl=en&geocode=FXg3fAEd6dH_AyF_rsIkOA6mpg&aq=&sll=24.91788,67.097065&sspn=0.007414,0.009645&vpsrc=0&mra=ls&ie=UTF8&t=m&ll=24.91788,67.097065&spn=0.007414,0.009645" style="color:#0000FF;text-align:left">View Larger Map</a></small> </div>

在文本区域中并使用mysql_real_escape_string(trim($_POST'map']))

但是从 mysql 表中获取数据时，由于 SQL 注入(inject)保护功能，它不会显示映射，即:mysql_real_escape_string() 如下:

<iframe width=\"186\" height=\"186\" frameborder=\"0\" scrolling=\"no\" marginheight=\"0\" marginwidth=\"0\" src=\"http://maps.google.com/maps?f=d&source=s_d&saddr=NIPA,+Karachi,+Pakistan&daddr=&hl=en&geocode=FXg3fAEd6dH_AyF_rsIkOA6mpg&aq=&sll=24.91788,67.097065&sspn=0.007414,0.009645&vpsrc=0&mra=ls&ie=UTF8&t=m&ll=24.91788,67.097065&spn=0.007414,0.009645&output=embed\"></iframe>
<br />
<small><a href=\"http://maps.google.com/maps?f=d&source=embed&saddr=NIPA,+Karachi,+Pakistan&daddr=&hl=en&geocode=FXg3fAEd6dH_AyF_rsIkOA6mpg&aq=&sll=24.91788,67.097065&sspn=0.007414,0.009645&vpsrc=0&mra=ls&ie=UTF8&t=m&ll=24.91788,67.097065&spn=0.007414,0.009645\" style=\"color:#0000FF;text-align:left\">View Larger Map</a></small> </div>

…………!

Answer 1

问题是您启用了 magic-quotes。
这是 php 中的重大错误之一(并将在版本 5.something 中从该语言中删除)。
在许多较旧的设置中，它仍然处于启用状态，并且最好禁用它，因为它不会增加任何安全性，但确实会增加很多麻烦。

如果(且仅当)您无法禁用它，您可以在执行 mysql_real_escape_string 之前使用 stripslashes()。