mysql_real_escape_string 删除整个字符串
我正在为我的网站编写一个身份验证系统，我想确保我免受 SQL 注入的影响。我正在使用“mysql_real_escape_string”，但这会完全清除字符串。用户名类似于“Damo”，但在运行该函数后它就消失了。
我做错了什么？ （没有 mysql_real_escape_string 也能正常工作）
$user_name = $_POST["username"];
$md5 = md5($_POST["password"]);
$user_name = mysql_real_escape_string($user_name);
$login = $query->GetSingleQuery("--SINGLE","SELECT user_name, id FROM url_users WHERE user_name='".$user_name."' and user_password='".$md5."';",array("user_name","id"));
I'm writing an authentication system for my site and I want to ensure I'm protected against SQL injection. I'm using 'mysql_real_escape_string' but this clears out the string completely. the username is something like 'Damo' but after running through the function it's gone.
What am I doing wrong? (it works fine without mysql_real_escape_string)
$user_name = $_POST["username"];
$md5 = md5($_POST["password"]);
$user_name = mysql_real_escape_string($user_name);
$login = $query->GetSingleQuery("--SINGLE","SELECT user_name, id FROM url_users WHERE user_name='".$user_name."' and user_password='".$md5."';",array("user_name","id"));
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
mysql_real_escape_string需要连接。假定该连接是作为同一库的一部分创建的。但是，
mysql_real_escape_string不是基于 OO 的，并且您显然正在为 OO$query使用其他库（它是什么？） 。因此 mysql_real_escape_string 无法“查看”您正在使用的连接，因此它无法工作。如果您打开错误报告（您确实应该这样做），您应该会看到为此生成的
E_WARNING。目前，我建议改为
mysql_escape_string。它的使用可能与您的数据库连接的字符集不匹配，但它现在可以满足您的需要，并且不需要连接。理想情况下，使用您实际使用的数据库库提供的转义函数。mysql_real_escape_stringrequires a connection. The connection is assumed to have been created as part of the same library.However,
mysql_real_escape_stringis not OO-based, and you're clearly using some other library for your OO$query(what is it?). Somysql_real_escape_stringcannot "see" the connection that you're using, and thus it cannot work.If you turn error reporting on (and you really should), you ought to see an
E_WARNINGgenerated for this.For now, I suggest
mysql_escape_stringinstead. Its use may not match the character set of your database connection, but it'll do you for now, and it doesn't require a connection. Ideally, use the escaping function provided through the DB library that you're actually using.尝试这个片段，我认为你对实际发生的事情的错误。
try this snippet, i think your wrong on what's actully happening.