PHP：在PDO之前处理引号exec

Question

我有一个我设计的表单，我的意图是接受任何UTF-8内容并将其插入MySQL数据库。我用charset utf-8作为连接数据库的编码来使用PDO。当内容包含单引号等字符时，插入查询仍然失败。在查询中使用它之前，我应该在输入内容中使用哪些内置函数。下面是刚刚被插入到数据库

INSERT INTO dbname.table 
       (input_xml) 
      VALUES 
       ('<?xml version="1.0" encoding="UTF-8" standalone="yes" ?> 
      <ip_Input> 
       <ip_xml> 
        Qaiku.com – What Can We 
        Learn From Failure?By Guest Blogger, September 11, 2012, Leave a 
        CommentEditor's note: I think we in the tech press have the tendency to 
        focus on the positive stories and forget about the startups that didn't live up 
        their expectations. Our Sofanatics coverage this past week has been one of the 
        few times we've covered abandoned projects, which is a pitty because there are a 
        lot to learn from "failures." Below we have a long read from Eero Holmila which 
        is one part eulogy, and another part what he's learned from the now-announced 
        shutdown of Qaiku.com.Qaiku.com might be a familiar name for some of the 
        readers of Arctic Startup. However, I am quite sure that the background and the 
        rough road from high hopes to a bitter decline probably is not. I am the CEO of 
        Rohea, a company behind a handful of quite successful Finnish websites like 
        Kotikokki.net, Kuvake.net, Mikseri.net and of course a less successful 
        Qaiku.com.I am going to share some lessons learned through the trip. I hope 
        some of it might be of use, spark up ideas or if nothing else, be at least a bit 
        entertaining. One last important disclaimer: all the opinions are my own.Now 
        without further delay, this is the story of 
        Qaiku. 
       </ip_xml> 
      </ip_Input> 
       '); 

Answer 1

你应该使用功能是PDOStatement::bindValue()之前形成的示例查询。在此之前，您还应该阅读SQL注入以及使用带参数化查询的PDO的正确方法。