使用mysqli_real_escape_string（）将数据写入mysql但没有＆

Question

iam using this code below, but the character "&" will not be inserted into the db, also when i copy/paste some text from other pages and put it into the db the text ends for example in the middle of the text, dont know why, i tried also addslashes() and htmlspecialchars() or htmlentities().

i read mysqli_real_escape_string() is againt SQL injection attacks and htmlspecialchars() against XSS attachs, should i also combine them ?

$beschreibung = mysqli_real_escape_string($db, $_POST['beschreibung']);   

Answer 1

SQL Injection is merely just improperly formatted queries. What you're doing is not enough, stop now. Get into the practice of using prepared statements..

$Connection = new mysqli("server","user","password","db");
$Query = $Connection->prepare("SELECT Email FROM test_tbl WHERE username=?");
$Query->bind_param('s',$_POST['ObjectContainingUsernameFromPost']);
$Query->execute();
$Query->bind_result($Email);
$Query->fetch();
$Query->close();

Above is a very basic example of using prepared statements. It will quickly and easily format your query.

My best guess to what is happening, I'm assuming you're just using the standard:

$Query = mysqli_query("SELECT * FROM test_tbl WHERE Username=".$_POST['User']);

As this query is not properly formatted you may have the quotes in your chunk of text which close the query string. PHP will then interpret everything as a command to send to the SQL server