mysql_real_escape_string（$值）不工作

Question

IM试图防止SQL注入与

mysql_real_escape_string($value) 

这里是我的代码，但它似乎是我得到一个空值，

$this->name_safe = mysqli_real_escape_string($this->name,$this->link); 

      $this->query = "INSERT INTO student (complete_name, date_birth, gender, email, student_status) 
      VALUES ('$this->name_safe', '$this->date', '$this->gender', '$this->email_1', 'current')"; 

？ thx

Answer 1

你有你的函数参数错误的顺序。数据库链接首先，然后字符串转义。

http://php.net/mysqli_real_escape_string

mysqli_real_escape_string($this->link, $this->name)