在这种情况下如何逃避报价？

Question

I want to return a new string after replacing any CHAR(10) by " " inside a string passed as the parameter of a function :

function executerCalcul($initial_string)
{
   $ret = "";
   $conn = new mysqli(BDD_SERVER, BDD_USER, BDD_PWD, BDD_NAME);
   if ($conn->connect_error) {
        trigger_error('Database connection failed: '  . $conn->connect_error, E_USER_ERROR);
   }
   if (stripos($initial_string, "'") === false)
        $sql = "SELECT REPLACE('$initial_string', char(10 using utf8),'
') as resultat";
   else
   {
        // how to write correctly $sql here because we are here in the case when there are single quotes inside the string parameter
   }
   $rs = $conn->query($sql);

   if($rs === false) {
        trigger_error('Wrong SQL: ' . $sql . ' Error: ' . $conn->error, E_USER_ERROR);
    } else {
                $rows_returned = $rs->num_rows;
    }
    $rs->data_seek(0);
    while($row = $rs->fetch_assoc()) {
        $ret .= $row['resultat'];
    }
    $rs->free();
    return $ret;
}

So how to escape single quotes in the case the string parameter contains single quotes ?

Answer 1

Use built-in functions as shown in documentation.

For example:

$new_query = $conn->real_escape_string($query);

and then execute the SQL normally.