我需要转义子查询吗？
我有一个如下的 SQL 查询：
UPDATE User SET flag='Y' WHERE email=(SELECT email FROM Forum WHERE id='$id');
因为 电子邮件地址 可以包含单引号和一些特殊字符 (s*a'{f`%$.=*+~&^#| g!/hd@[66.112.45.34] 和 vy."(),:;<>[]".VY."vy\\ \@\"vy"[email protected] 都是有效的电子邮件地址），我不确定是否是有必要单独执行子查询，转义输出，然后在主查询中使用它，
是什么？
您的建议 注意：$id 是一个安全号码。
I have a SQL query that goes like this:
UPDATE User SET flag='Y' WHERE email=(SELECT email FROM Forum WHERE id='$id');
Because the email address can consist of single quotes and some special characters (s*a'{f`%$.=*+~&^#|g!/hd@[66.112.45.34] and vy."(),:;<>[]".VY."vy\\ \@\"vy"[email protected] are both valid email addresses), I am not sure whether it is necessary to do the subquery separately, escape the output, followed by using it in the main query.
What is your suggestion?
ADD NOTE: $id is a safe number.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您不需要转义任何内容，因为有子查询，但当然您需要转义 id 值以将其放入字符串中。
如果可能，您应该使用参数化查询，而不是将值连接到字符串中。那么你就不必逃避任何事了。
You don't need to escape anything because there is a subquery, but of course you need to escape the
idvalue to put it in the string.If possible, you should use a parameterised query instead of concatenating the value into the string. Then you don't have to escape anything.
您不需要转义子查询中的任何内容。但是，无论最初将电子邮件插入数据库的任何查询都需要转义该字段。当您添加或修改
email字段时，请进行转义。You should not need to escape anything in your subquery. However, whatever query inserts email originally to your database needs to escape that field. Escaping should take please when you add or modify the
emailfield.需要回答的信息是：“$id 从哪里来？”
如果可以从外部修改，则需要引用。例如，如果它作为 GET 参数
http://www.foo.com/foo.php?id=222传递，则需要引用它（与 POST 相同）。通过一点引号，参数可以关闭子查询，并且可以执行每个查询，例如，通过提供
"'); DELETE * FROM User; --" 作为$ 的值id:The information needed to answer is: "Where does $id come from?"
If it can be modified externally it needs to be quoted. If it is for example passed as an GET argument
http://www.foo.com/foo.php?id=222it needs to be quoted (same for POST).With a little bit of quotation the parameter can close the subquery and every query could be executed, e. g., by providing
"'); DELETE * FROM User; --" as a value for$id: