PHP:在PDO执行之前处理引号

时间:2013-03-22 04:02:10

标签: php mysql insert pdo simplexml

我有一个我设计的表单,我的意图是接受任何UTF-8内容并将其插入MySQL数据库。我使用PDO和charset utf-8作为连接数据库的编码。当内容包含单引号等字符时,插入查询仍然失败。在使用查询之前,我应该在输入内容上使用什么内置函数。下面是插入数据库之前形成的示例查询

    INSERT INTO dbname.table 
               (input_xml) 
           VALUES 
               ('<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
            <ip_Input>
                 <ip_xml>
                    Qaiku.com – What Can We 
                    Learn From Failure?By Guest Blogger, September 11, 2012, Leave a 
                    CommentEditor's note: I think we in the tech press have the tendency to 
                    focus on the positive stories and forget about the startups that didn't live up 
                    their expectations. Our Sofanatics coverage this past week has been one of the 
                    few times we've covered abandoned projects, which is a pitty because there are a 
                    lot to learn from "failures." Below we have a long read from Eero Holmila which 
                    is one part eulogy, and another part what he's learned from the now-announced 
                    shutdown of Qaiku.com.Qaiku.com might be a familiar name for some of the 
                    readers of Arctic Startup. However, I am quite sure that the background and the 
                    rough road from high hopes to a bitter decline probably is not. I am the CEO of 
                    Rohea, a company behind a handful of quite successful Finnish websites like 
                    Kotikokki.net, Kuvake.net, Mikseri.net and of course a less successful 
                    Qaiku.com.I am going to share some lessons learned through the trip. I hope 
                    some of it might be of use, spark up ideas or if nothing else, be at least a bit 
                    entertaining. One last important disclaimer: all the opinions are my own.Now 
                    without further delay, this is the story of 
                    Qaiku.
                </ip_xml>
           </ip_Input>
              ');

1 个答案:

答案 0 :(得分:0)

您应该使用的功能是PDOStatement::bindValue()。在此之前,您还应该阅读SQL注入以及将PDO用于参数化查询的正确方法。