如何通过编写引号来阻止人们破坏您的评论系统[重复]

Question

This question already has an answer here:

• How can I prevent SQL injection in PHP? 28 answers

im making a comment system in my website. However, the commentor can break the system by typing special characters such as quotes, double quotes, semi-colons,colons etc. This is not a duplicate, i want to make sure that htmlentities are converted before it get to the database, i could use str_replace but it actually prints the literal code. for example: "

like this example:

$str ="Hi there bro what's up, im a "MEGA"";
$comment = $str;
echo $comment;

however it spits out errors, because they break the query because of the quotation marks.

</div>

Answer 1

If you're using MySQL and php mysql you have to pass data through the mysql_real_escape_string() function.

For example, before inserting into database:

$comment = mysql_real_escape_string($_POST['comment']);

Then, for printing your HTML:

<p><?=htmlspecialchars($Rs['comment'])?></p>

mysql_real_escape_string()

htmlspecialchars()