Question

我正在尝试在PHP中运行此SQL查询：

UPDATE 
    billing_calldata 
SET 
    status = 'c', 
    customer = '475', 
    description = 'UK Mobile VMNO C&W (fw7-C&W)', 
    customer_cost = '0.00720416666666667', 
    customer_ac = '0', 
    customer_sc = '0', 
    reseller_cost = '0', 
    reseller_ac = '0', 
    reseller_sc = '0'

WHERE sequence = 10364723

但是它返回了这个错误：

UPDATE 
    billing_calldata 
SET 
    status = 'c', 
    customer = '475', 
    description = 'UK Mobile VMNO CYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''UK Mobile VMNO C' at line 1

description为UK Mobile VMNO C&W (fw7-C&W)

但查询可以直接在phpMyAdmin

中正常工作

查询源自我的vb.net应用程序：

SQL = "UPDATE billing_calldata SET " _
                         & "status = 'c', " _
                         & "customer = '" & customer_sequence & "', " _
                         & "description = '" & description & "', " _
                         & "customer_cost = '" & customer_cost & "', " _
                         & "customer_ac = '" & customer_ac & "', " _
                         & "customer_sc = '" & customer_sc & "', " _
                         & "reseller_cost = '" & reseller_cost & "', " _
                         & "reseller_ac = '" & reseller_ac & "', " _
                         & "reseller_sc = '" & reseller_sc & "' " _
                         & "WHERE sequence = " & sequence & " "
                    SQL = "apikey=1nt3gr4&submittedSQL=" + SQL

然后我将这个发送请求发送到PHP页面，其中包含以下内容：

if($_POST["apikey"] <> '' and $_POST["apikey"] == '1nt3gr4' and $_POST["submittedSQL"] <> '') {
    $sql = $_POST["submittedSQL"];
    mysql_query($sql, $conn) or die(mysql_error());
}

Answer 1

使用real_escape_string：

转义特殊字符

$description = $mysqli->real_escape_string($description);

然后在$description中使用UPDATE。

PHP SQL Update查询失败

1 个答案: