douzhaolu4839 2012-10-05 14:15
浏览 65
已采纳

如何在JOOMLA 2.5中的数据库中插入数据时转义引号

I am trying to insert data in database(mysql) but not successful when i am trying to add data with single or double quotes.Its working fine otherwise(without Quote). I know we have to use mysql_real_escape_string in such situations.But i am using joomla framework where this function is not working.

My code is below:

function insert($table, $array) {
$db = JFactory::getDBO();
 $query = "INSERT INTO ".$table;
  $fis = array();
  $vas = array();
  foreach($array as $field=>$val) {

 if(is_array($val)){
 $x= implode(",",$val);
 }
 else
 {
 $x=$val;
 }

   $fis[] = "`$field`";//you must verify keys of array outside of function;
                         //unknown keys will cause mysql errors;
                         //there is also sql injection risc;
    $vas[] = "'".$x."'";
  }
$query .= " (".implode(", ", $fis).") VALUES (".implode(", ", $vas).")";
$db->setQuery($query);
$db->query();
}
insert('#__storage_companies',JRequest::get( 'post' ));

Please tell me how to get rid of this.

  • 写回答

2条回答 默认 最新

  • dongxi1320 2012-10-05 15:28
    关注

    See JDatabaseDriver::quote. Used like $db->quote($value). Also to quote field names, use $db->quoteName($value).

    Take a look at Preparing the query from the Joomla wiki.

    You code should be like:

    $fis[] = $db->nameQuote($field);
    $vas[] = $db->quote($x);
    
    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(1条)

报告相同问题?

悬赏问题

  • ¥20 求一个html代码,有偿
  • ¥100 关于使用MATLAB中copularnd函数的问题
  • ¥20 在虚拟机的pycharm上
  • ¥15 jupyterthemes 设置完毕后没有效果
  • ¥15 matlab图像高斯低通滤波
  • ¥15 针对曲面部件的制孔路径规划,大家有什么思路吗
  • ¥15 钢筋实图交点识别,机器视觉代码
  • ¥15 如何在Linux系统中,但是在window系统上idea里面可以正常运行?(相关搜索:jar包)
  • ¥50 400g qsfp 光模块iphy方案
  • ¥15 两块ADC0804用proteus仿真时,出现异常