PHP SQL 更新查询失败

Question

我正在尝试在 PHP 中运行此 SQL 查询:

UPDATE 
    billing_calldata 
SET 
    status = 'c', 
    customer = '475', 
    description = 'UK Mobile VMNO C&W (fw7-C&W)', 
    customer_cost = '0.00720416666666667', 
    customer_ac = '0', 
    customer_sc = '0', 
    reseller_cost = '0', 
    reseller_ac = '0', 
    reseller_sc = '0' 

在哪里 序列 = 10364723

但是它返回了这个错误:

UPDATE 
    billing_calldata 
SET 
    status = 'c', 
    customer = '475', 
    description = 'UK Mobile VMNO CYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''UK Mobile VMNO C' at line 1

描述是UK Mobile VMNO C&W (fw7-C&W)

但是直接在 phpMyAdmin 中查询工作正常

查询源 self 的 vb.net 应用程序:

SQL = "UPDATE billing_calldata SET " _
                         & "status = 'c', " _
                         & "customer = '" & customer_sequence & "', " _
                         & "description = '" & description & "', " _
                         & "customer_cost = '" & customer_cost & "', " _
                         & "customer_ac = '" & customer_ac & "', " _
                         & "customer_sc = '" & customer_sc & "', " _
                         & "reseller_cost = '" & reseller_cost & "', " _
                         & "reseller_ac = '" & reseller_ac & "', " _
                         & "reseller_sc = '" & reseller_sc & "' " _
                         & "WHERE sequence = " & sequence & " "
                    SQL = "apikey=1nt3gr4&submittedSQL=" + SQL

然后我将其发送到 PHP 页面的 Post 请求中，其中包含以下内容:

if($_POST["apikey"] <> '' and $_POST["apikey"] == '1nt3gr4' and $_POST["submittedSQL"] <> '') {
    $sql = $_POST["submittedSQL"];
    mysql_query($sql, $conn) or die(mysql_error());
}

Answer 1

用real_escape_string 转义特殊字符:

$description = $mysqli->real_escape_string($description);

然后在 UPDATE 中使用 $description。