php - 在 MySQL 查询中插入 "&"或 "%"等字符

Question

我想在查询中插入特殊字符(例如“&”或“%”)，但每次尝试时，我插入的字符串都会被剪切。

例如，如果我输入“Bolliger&Mabillard 是一家过山车制造商”，我只会得到“Bolliger”。

我用来将字符串插入数据库的代码是:

include("connect.php");

$query="insert into news (title, body) values('About', 'Bolliger&Mabillard is a rollercoaster manufacturer');";
$run = mysql_query($query) or die ($query);
mysql_close();

我能做什么？

谢谢!

Answer 1

希望这会对您有所帮助...

最短路线就在这里...(使用mysql预定义函数)

<?php
    include("connect.php");
    $bodyData = "Bolliger&Mabillard%is a rollercoaster manufacturer";
    $bodyData = mysql_real_escape_string($bodyData);
    $query="insert into news (title, body) values('About', '".$bodyData."')";
    $run = mysql_query($query) or die ($query);
    mysql_close();
 ?>

或者你可以采取更长的方式，如下所示......(使用你自己的函数)

<?php
    include("connect.php");

    function xss($string)
        {
            return str_replace(
                            array('!','"','#','$','%','&',"'",'(',')','*','+',',','-','.','/',':',';','<','=','>','?','@','[','\\',']','^','_','{','|','}','~'),
                            array('\!','\"','\#','\$','\%','\&',"\'",'\(','\)','\*','\+','\,','\-','\.','\/','\:','\;','\<','\=','\>','\?','\@','\[','\\','\]','\^','\_','\{','\|','\}','\~'),
                            $string);
        }


    $bodyData = "Bolliger&Mabillard%is a rollercoaster manufacturer";
    $bodyData = xss($bodyData);
    $query="insert into news (title, body) values('About', '".$bodyData."')";
    $run = mysql_query($query) or die ($query);
    mysql_close();
    ?>

使用此代码您将得到结果...

 <?php
    include("connect.php");


    function xss_r($string)
        {
            return str_replace(
                            array('\!','\"','\#','\$','\%','\&',"\'",'\(','\)','\*','\+','\,','\-','\.','\/','\:','\;','\<','\=','\>','\?','\@','\[','\\','\]','\^','\_','\{','\|','\}','\~'),
                            array('!','"','#','$','%','&',"'",'(',')','*','+',',','-','.','/',':',';','<','=','>','?','@','[','\\',']','^','_','{','|','}','~'),
                            $string);
        }
    $last = 1; // here your id which is compare with id in database...
    $rs = mysql_query("select body from members where id = ".$last);
    $row = mysql_fetch_array($rs);
    echo xss_r($row['body']);
    mysql_close();
    ?>