mysql_escape_string

(PHP 4 >= 4.0.3, PHP 5)

mysql_escape_string — 转义一个字符串用于 mysql_query

说明

string mysql_escape_string ( string $unescaped_string )

本函数将 unescaped_string 转义，使之可以安全用于 mysql_query() 。

Note: mysql_escape_string() 并不转义 % 和 _。本函数和 mysql_real_escape_string() 完全一样，除了 mysql_real_escape_string() 接受的是一个连接句柄并根据当前字符集转移字符串之外。 mysql_escape_string() 并不接受连接参数，也不管当前字符集设定。

Example #1 mysql_escape_string() 例子

  <?php
    $item  =  "Zak's Laptop" ;
     $escaped_item  =  mysql_escape_string ( $item );
     printf  ( "Escaped string: %s\n" ,  $escaped_item );
 ?>

以上例子将产生如下输出：

Escaped string: Zak\'s Laptop

参见 mysql_real_escape_string() ， addslashes() 和 magic_quotes_gpc 指令。

用户评论:

[#1] PHPguru [2015-03-15 02:54:54]

You can use this function safely with your MySQL database queries if and only if you are sure that your database connection is using ASCII, UTF-8, or ISO-8859-* and that the backslash is your database's escape character. If you're not sure, then use mysqli_real_escape_string instead. This function is not safe to use on databases with multi-byte character sets.

The only benefit of this function is that it does not require a database connection.

[#2] s dot marechal at jejik dot com [2011-01-26 02:37:22]

The exact characters that are escaped by this function are the null byte (0), newline (\n), carriage return (\r), backslash (\), single quote ('), double quote (") and substiture (SUB, or \032).