PHP：在mySQL中插入引号时出错

Question

I insert a text variable in a mySQL table. Everything works fine except in the text is a quotation mark. I thought that I can prevent an error by using "mysql_real_escape_string". But there is an error anyway.

My insert statement:

 $insertimage= "INSERT INTO image(filename,text,timestamp,countdown) VALUES ('$filename','$text','$timestamp','$countdown')";
 mysql_real_escape_string($insertimage);

The error message: MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1413885955514','10')' at line 1

Answer 1

The problem with your current code is that you have not correctly escaped the values you're trying to enter into the table.

Better still is to avoid the mysql_* function family entirely. Those functions are now deprecated and bring security risks to the table (along with other concerns).

You'd be better to use PDO and Prepared Statements, for example:

$db = new PDO('param1', 'param2', 'param3');
$sql = $db->prepare( 'INSERT INTO `image` (`filename`, `text`, `timestamp`, `countdown`) 
                                   VALUES (:filename, :text, :timestamp, :countdown)' );

$sql->execute( array(':filename' => $filename, 
                     ':text' => $text, 
                     ':timestamp' => $timestamp, 
                     ':countdown' => $countdown )
);