douban5644 2011-06-30 06:14
浏览 17
已采纳

mysql真正转义包含对象的数组?

I have an array that I need to sanitize before putting it in a cell on a mysql database. The code i'm trying seems to work. But as soon as there are characters like ' it throws errors and thats not good. Here's what i've tried, any ideas whats wrong?

 function submitLogDb($array,$id,$title)
       {
            function mysql_real_escape_array($var) 
            {
                foreach($var as $line)
                {
                mysql_real_escape_string($line['msg']);
                }

              return $var;
            }


            $title=mysql_real_escape_string($title);

            $array=mysql_real_escape_array($array);

            return mysql_query("INSERT INTO logs (text,id,title) VALUES ('".serialize($array)."','$id','$title')");


       }

EDIT: Just incase it helps, heres what some of the objects might look like in the array:

[1] 
  icon = ""
  msg = "this is a test"
  name = "Them: "
  systemMsg = 0
[2]
  icon = ""
  msg = "yep it sure is"
  name = "You: "
  systemMsg = 0
  • 写回答

1条回答 默认 最新

  • doulao1966 2011-06-30 06:26
    关注

    mysql_real_escape_string the output of serialization of the array.

    $data_to_insert = mysql_real_escape_string(serialize($array));
    
    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥60 求一个简单的网页(标签-安全|关键词-上传)
  • ¥35 lstm时间序列共享单车预测,loss值优化,参数优化算法
  • ¥15 基于卷积神经网络的声纹识别
  • ¥15 Python中的request,如何使用ssr节点,通过代理requests网页。本人在泰国,需要用大陆ip才能玩网页游戏,合法合规。
  • ¥100 为什么这个恒流源电路不能恒流?
  • ¥15 有偿求跨组件数据流路径图
  • ¥15 写一个方法checkPerson,入参实体类Person,出参布尔值
  • ¥15 我想咨询一下路面纹理三维点云数据处理的一些问题,上传的坐标文件里是怎么对无序点进行编号的,以及xy坐标在处理的时候是进行整体模型分片处理的吗
  • ¥15 CSAPPattacklab
  • ¥15 一直显示正在等待HID—ISP