niceEDIT和PHP / MySQL特殊字符

Question

嗨我有一个带有文本区域的表单，其中包含描述性文本，其中包含标点符号，如逗号等。

在我使用过这个

的PHP脚本上

$description    = empty( $_POST['inputDescription'])? 'NULL': "'" .  mysql_real_escape_string($_POST['inputDescription']) . "'";

但是在提交包含逗号的文本时，我仍然会收到语法错误。

您的SQL语法出错;检查与MySQL服务器版本对应的手册，以便在 附近使用正确的语法

任何想法都会很棒我会把头发拉出来！

编辑大量代码（对不起）

<?php
    session_start();
    include "includes/connection.php";

    $contact        = $_POST['inputName'];
    $company    = $_POST['inputCompany'];
    $region             = $_POST['inputRegion'];
    $address1   = $_POST['inputAddress1'];
    $address2   = empty( $_POST['inputAddress2'])? 'NULL'   : "'" . mysql_real_escape_string(  $_POST['inputAddress2']) . "'";
    $city               = $_POST['inputCity'];
    $county             = empty( $_POST['inputCounty'])? 'NULL' : "'" . mysql_real_escape_string(  $_POST['inputCounty']) . "'";
    $postcode   = $_POST['inputPostcode'];
    $email          = empty( $_POST['inputEmail'])? 'NULL'  : "'" . mysql_real_escape_string(  $_POST['inputEmail']) . "'";
    $telephone1 = $_POST['inputPhoneOne'];
    $telephone2 = empty( $_POST['inputPhoneTwo'])? 'NULL'   : "'" . mysql_real_escape_string(  $_POST['inputPhoneTwo']) . "'";
    $website        = empty( $_POST['inputWebsite'])? 'NULL'    : "'" . mysql_real_escape_string(  $_POST['inputWebsite']) . "'";
    $description    = empty( $_POST['inputDescription'])? 'NULL': "'" .  mysql_real_escape_string($_POST['inputDescription']) . "'";
    $userid             = $_POST['inputUserID'];

    if(
    $contact == '' || 
    $company == '' ||  
    $address1 == '' || 
    $address2 == '' || 
    $city == '' || 
    $county == '' || 
    $postcode == '' ||  
    $telephone1 == '' || 
    $telephone2 == '' || 
    $email == '' || 
    $website == '' || 
    $description == '' || 
    $region == '' ||  
    $userid == ''){
    $_SESSION['status'] = 'error';
    } else {
        mysql_query("INSERT INTO RegionalContacts
                (`bID`,`user_id`,`Name`,`Company`,`Address1`,`Address2`,`City`,`County`,`Postcode`,`Telephone1`,`Telephone2`,`eMail`,`Website`,`Description`,`Region`)
VALUES(NULL,'$userid','$contact','$company','$address1',$address2,'$city',$county,'$postcode','$telephone1',$telephone2,$email,$website,$description,'$region')") or die(mysql_error());
        $_SESSION['status'] = 'success';
    }
    header("location: regionalContacts.php");
?>

Answer 1

你的插入语句看起来有值（我假设）是传递给它的字符串，没有引号，例如address2，county，telephone2，email，website和description。这会导致语法错误。

Answer 2

INSERT语句中的某些值引用了它们，其他值则没有：

'$telephone1',$telephone2

使用预备语句来避免此类错误......