Saturday 16 December 2017

How to escape php mysqli query?

I am passing data from AJAX to my PHP. I just run a
for loop to make my query. Problem with my data is that it
contains single quote.



I am using single quote
to enclose my parameters in the query. Query is something
like




 INSERT INTO
myTable (column1.column2) VALUES('value1', 'value2'),
('value'1',
'value2');


I want to
escape like



 INSERT INTO myTable
(column1.column2) VALUES('value1', 'value2'),
('value\'1',
'value2');



I
just tried mysqli_real_Escape_String. It returns something
like



 INSERT INTO myTable
(column1.column2) VALUES(\'value1\', \'value2\'),
(\'value\'1\',
\'value2\');


So Query
execution fails.



I don't think using
htmlspeciachars is the right way for
this.




Any
suggestions?

No comments:

Post a Comment

php - file_get_contents shows unexpected output while reading a file

I want to output an inline jpg image as a base64 encoded string, however when I do this : $contents = file_get_contents($filename); print &q...