适当的mySQL命令用于添加URL

Question

I'm having a problem when trying to add a URL to a mySQL database.

The string is a URL:

http://pbs.twimg.com/profile_images/1708867059/405000_10150426314376065_707061064_8645107_703731598_n_normal.jpg

The error I get is:

Error description: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '://pbs.twimg.com/profile_images/1708867059/405000_10150426314376065_707061064_86' at line 1

It seems as though it won't allow me to add a URL, I presume there is something wrong with some of the characters but I don't know what?

My SQL is:

INSERT INTO accounts (name,consumerkey,consumersecret,pic_url) VALUES ($twitterID,$consumerkey,$consumersecret,$picture_url)"

Answer 1

You cannot truly solve this kind of problem by adding a few characters (like ' or ") to your bespoke sql string!

Instead, get to know the real way to write sql in php (it's like a very badly kept secret), which is to use PDO statements. This will allow you to use placehoders like (:twitterID, :consumerKey, :consumerSecret, :pictureUrl) which will accept complex variables such as urls and any of the crap users send in much more gracefully.

In the long run, this will save you a lot of trouble and time.