参考 mysql_real_escape_string mysqli_real_escape_string
mysql_real_escape_string是用来转义字符的,主要是转义POST或GET的参数,防治SQL注入(防注入可参考PHP防SQL注入不要再用addslashes和mysql_real_escape_string了),但是 自 PHP 5.5.0 起已废弃,并在自 PHP 7.0.0 开始被移除
替代的有mysqli_real_escape_string,不过mysqli_real_escape_string要求必须链接数据库。
$link = mysqli_connect("localhost", "username", "password"); /* check connection */ if (mysqli_connect_errno()) { printf("Connect failed: %s\n", mysqli_connect_error()); exit(); } $city = "'s Hertogenbosch"; $city = mysqli_real_escape_string($link, $city); echo $city;
结果:
\'s Hertogenbosch