如何防止撇号被删除 PHP MySQL
我有一个需要用户名的注册系统。有些人的姓氏中有撇号，这会阻止数据写入 MySQL 数据库表（例如 O'Hare）。
我正在使用 mysql_real_escape_string ，它从字符串中删除撇号。这很好，除非我需要针对 Web 服务使用带有撇号的值，否则 Web 服务将返回 false。
我想我可以在使用 mysql_real_escape_string 之前使用 Web 服务进行名称检查，但这会带来安全缺陷吗？或者 SOAP Web 服务是否已经对干净的输入进行了自己的检查？
或者有没有更好的方法来传递变量，PHP 保留撇号但仍然保持它的安全并且 MySQL 可以接受它？
I have a registration system which requests a users name. Some people have an apostrophe in their surname and it's preventing the data from being written to the MySQL database table (e.g. O'Hare).
I am using mysql_real_escape_string which is removing the apostrophe from the string. This would be fine except I need to use the value with the apostrophe against a Web Service, otherwise the Web Service will return false.
I was thinking I could do the name check with the Web Service before using mysql_real_escape_string, but could this present a security flaw? Or do SOAP Web Services already do their own checks for clean inputs?
Or is there a better way of passing through the variable whereby PHP retains the apostrophe but still keeps it secure and MySQL can accept it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您应该向我们展示一些代码，因为
mysql_real_escape_string不会删除撇号，而只会转义它们。转义意味着
O'Hare将变为O\'Hare，以便可以将其作为字符串插入：'O\'Hare'。从数据库检索后，您的值仍应是原始的O'Hare。因此，如果撇号“丢失”，则程序逻辑中的其他地方可能存在错误。
另一个选项是从使用 MySQL 库切换到 MySQLi 或 PDO 库来访问数据库。后两者支持准备好的陈述。准备好的语句通常被认为是查询数据库的最佳实践。
You should show us some code, because
mysql_real_escape_stringwill not remove an apostrophe, but only escape them.Escaping means
O'Harewill becomeO\'Hareso that it can be inserted as a string:'O\'Hare'. Upon retrieval from the database, your value should still be the originalO'Hare.So, if the apostrophe is 'lost' there likely is an error somewhere else in your program logic.
The other option is to switch from using the MySQL library to the MySQLi or PDO library for accessing your database. The latter two support prepared statements. Prepared statements are generally thought as being the best practice for querying your database.
mysql_real_escape_string()不会删除撇号。您的问题可能出在输出端，或者某个其他函数干扰了输入。
mysql_real_escape_string()will not remove apostrophes.Your problem is likely on the output side, or some other function messing with the input.
在使用
mysql_real_escape_string之前，您需要打开一个数据库连接，否则会出现故障。You need to have a database connection open before you use
mysql_real_escape_stringor it will malfunction.