MySQL撇号的错误

Question

How would I go about inserting apostrophes ' into MySQL without it throwing any errors in PHP. What would be the proper way to echo them out from MySQL too.

Thanks

Answer 1

You need to consider both PHP and MySQL, and if you are using a framework, that too.

As far as PHP is concerned, you need to use the opposite style of quote from those contained in your string, or else "escape" them, like this:

$string = 'this is not a problem; it\'s escaped.';
$string = "I don't need to escape";

As for MySQL, you should use an escaping function, like mysql_real_escape_string or similar.

There is a more advanced technique for using user-supplied data in queries called "prepared statements", which is the most robust and safe way to achieve dynamic queries with user-supplied parameters. See this section of the docs to get started.