PHP - 在没有引号的情况下在MySQL中输入查询

Question

我在尝试在MySQL中输入数据时没有用引号引起问题。

下面是它如何出现在MySQL的截图

下面是INSERT INTO代码，将其放入数据库中，我需要它输入到MySQL没有它被证明是具有挑战性的报价...

<?php include('db_connect.inc');?> 

<?php 
$result = $conn->prepare("INSERT INTO dog_park.reviews (review_text, username, date, rating, item) VALUES (:review, :id, :date, :rating, :keyword)"); 
$result->bindParam(':review', $value1); 
$result->bindParam(':id', $value2); 
$result->bindParam(':date', $value3); 
$result->bindParam(':rating', $value4); 
$result->bindParam(':keyword', $value5); 


$value1 = $_POST['review']; 
$value2 = $_SESSION['id']; 
$value3 = $date = date("Y-m-d"); 
$value4 = $_POST['rating']; 
$value5 = $_SESSION['KEYWORD']; 
$result->execute(); 
echo "Review entry Successful, you will now be redirected to the home page"; 

header("refresh:10; url=index.php"); 
?> 

也许与$ _SESSION有关？

Answer 1

也许修剪出在每个发布值的两侧多余的行情可以做的伎俩为你喜欢这样：

<?php 
     include('db_connect.inc'); 
     $result = $conn->prepare("INSERT INTO dog_park.reviews (review_text, username, date, rating, item) VALUES (:review, :id, :date, :rating, :keyword)"); 

     $date = date("Y-m-d"); 
     $value1 = trim($_POST['review'],  "'\""); 
     $value2 = trim($_SESSION['id'],   "'\""); 
     $value3 = trim($date,     "'\""); 
     $value4 = trim($_POST['rating'],  "'\""); 
     $value5 = trim($_SESSION['KEYWORD'], "'\""); 

     $result->bindParam(':review', $value1); 
     $result->bindParam(':id',  $value2); 
     $result->bindParam(':date',  $value3); 
     $result->bindParam(':rating', $value4); 
     $result->bindParam(':keyword', $value5); 

     $result->execute(); 
     echo "Review entry Successful, you will now be redirected to the home page"; 

     header("refresh:10; url=index.php"); 
    ?> 

Answer 2

使用stripslashes(string $str)联合国引号引用的字符串。

但在你的情况，你需要逃逸特殊字符串中的字符用在SQL语句中让你用：mysql_real_escape_string

mysql_real_escape_string（）调用MySQL的库函数mysql_real_escape_string，其中前添加反斜杠以下字符：\ X00，\ n，\ r，\，”，“和\ X1A

例如：。

<?php 
// We have not connected to MySQL 

$lastname = "O'Reilly"; 
$_lastname = mysql_real_escape_string($lastname); 

$query = "SELECT * FROM actors WHERE last_name = '$_lastname'"; 

var_dump($_lastname); 
var_dump($query); 
?>