是否有内置函数来转义Oracle查询的字符串？ （比如MySQL的mysql_real_escape_string）

Question

I understand that the proper way to handle all SQL query nowadays should be using PDO (or use the function provided in a PHP framework, like eloquent in laravel) However, as there is mysql_real_escape_string for MySQL, I am curious if there is a function like that for Oracle in PHP?

I have searched on Google and most answer seems to be writing a string replace code by yourself. That works at least on some common problem like quote ('), but I am just curious if there are built-in function for that. (and just in case there are other escape needed to be done to prevent SQL injection)

Answer 1

There is a package DBMS_ASSERT. It is dedicate to prepare and validate input string. DBMS_ASSERT
ENQUOTE_LITERAL function

If want to hardcore string literals you can use quitting mechanism.
q'( ... )'
q'~ ... ~'
q'! ... !'

DECLARE
       v VARCHAR2(1024);
    BEGIN
       v := q'( The string  with quouts ',','   )';
       DBMS_OUTPUT.PUT_LINE(v);
    END;