<?php // 1.连接数据库 $conn = mysql_connect('127.0.0.1:3306', 'root', '518666'); if (!$conn) { die("could not connect:" . mysql_error()); } // 2.选择数据库 mysql_select_db('mysql_safe', $conn); // 3.设置编码,注意这里是utf8而不是utf-8,如果写后者，mysql不会识别的，会出现乱码的。 mysql_query("set names utf8"); $title = "我们的爱情"; $content = '你是/谁啊，大几\都"老梁"做做&>women<a>没'; $add_time = date("y-m-d h:i:s"); // 转义字符 $content = mysql_real_escape_string($content); $content = htmlspecialchars($content, ent_compat); // 你是/谁啊，大几都做做&>women<a>没 // 自动过滤反斜杠 /* // 4.插入一条数据 $insert_sql = "insert into post_tbl (title, content, user_id, add_time) values ('{$title}', '{$content}', '4742551', '{$add_time}')"; if(mysql_query($insert_sql)) { echo 'ok'; } else { echo "error : " . mysql_error(); } $ret = mysql_affected_rows(); print_r($ret); */ // 5.pdo预处理插入 // pdo（php data object）则是提供了一个 abstraction layer 来操作数据库 // 查询 $user_id = 174742; $password = "''or '1=1'" ; $sql = "select * from post_tbl where user_id = {$user_id} and password = {$password}"; print_r($sql); $query = mysql_query($sql); // $result = mysql_fetch_array($query); $rows = array(); while($row=mysql_fetch_array($query)) { $rows[] = $row; } print_r( $rows); // 关闭数据库连接 mysql_close($conn); /* $str = "bill & 'steve'"; echo htmlspecialchars($str, ent_compat); // 只转换双引号 echo "<br>"; echo htmlspecialchars($str, ent_quotes); // 转换双引号和单引号 echo "<br>"; echo htmlspecialchars($str, ent_noquotes); // 不转换任何引号 */ /* 以上代码的 html 输出如下（查看源代码）： <!doctype html> <html> <body> bill & 'steve'<br> bill & 'steve'<br> bill & 'steve' </body> </html> 以上代码的浏览器输出： bill & 'steve' bill & 'steve' bill & 'steve' */ function mforum_html_tag_to_html_entity($content) { $content = (string)trim($content); if(empty($content)) return ''; // $content = str_replace(' ', ' ', $content); $content = htmlspecialchars($content, ent_compat, gb2312, false); $content = str_replace(">", ">", $content); $content = str_replace("<", "<", $content); $content = str_replace("\"", """, $content); $content = preg_replace("/\\\$/", "$", $content); $content = preg_replace("/\r/", "", $content); $content = str_replace("!", "!", $content); $content = str_replace("'", "'", $content); $content = preg_replace("/\\\/", "\", $content); // 内容敏感词过滤 return $content; }
二、pdo处理的sql语句
<?php // pdo的使用 // http://blog.csdn.net/qq635785620/article/details/11284591 $dbh = new pdo('mysql:host=127.0.0.1:3306;dbname=mysql_safe', 'root', '518666'); $dbh->setattribute(pdo::attr_errmode, pdo::errmode_exception); $dbh->exec('set names utf8'); $title = "我们的爱情"; $content = '你是/谁啊，大几\都"老梁"做做&>women<a>没' . " 测试打印号'我是单引号'哈哈"; $user_id = 174742; $add_time = date("y-m-d h:i:s"); // $insert_sql = "insert into post_tbl (title, content, user_id, add_time) values (:x_title, :x_content, :x_user_id, :x_add_time)"; // $stmt = $dbh->prepare($insert_sql); // $stmt->execute(array('x_title'=>$title,':x_content'=> $content, ':x_user_id' => $user_id, ':x_add_time' => $add_time)); // 查询 $user_id = "17474#"; // $password = "''or '1=1'"; $password = 123456; $sql = 'select * from post_tbl where user_id = :x_user_id and password = :x_password'; $stmt = $dbh->prepare($sql); $stmt->execute(array(':x_user_id'=>$user_id, ':x_password' => $password)); $rows = array(); while($row = $stmt->fetch(pdo::fetch_assoc)) { $rows[] = $row; } print_r($rows); // echo $dbh->lastinsertid();