php mysql html 转义字符串,PHP＆amp; MySQL输入字符串转义问题

include("database.php");

function security_sql($x){

return mysql_real_escape_string(trim(stripslashes($x)));

}

$title = security_sql($_POST["article_title"]);

$first_name = security_sql($_POST["article_author"]);

$description = security_sql($_POST["article_summary"]);

$category = security_sql($_POST["article_category"]);

$article = security_sql($_POST["article_body_text"]);

$article_html = security_sql($_POST["article_body_html"]);

$resource_box = security_sql($_POST["article_bio_text"]);

$resource_box_html = security_sql($_POST["article_bio_html"]);

$keywords = security_sql($_POST["article_keywords"]);

$email = security_sql($_POST["article_email"]);

// Writes fine to text file

$fp = fopen('test.txt', 'a');

fwrite($fp, $title."n");

fwrite($fp, $article."nnnn");

fclose($fp);

// BUT DOESNT WORK FINE WITH MYSQL

mysql_query("INSERT INTO articles (first_name, email, title, description, article, article_html, category, resource_box, resource_box_html, keywords, distributor, distributor_host) values (

'".$first_name."',

'".$email."',

'".$title."',

'".$description."',

'".$article."',

'".$article_html."',

'".$category."',

'".$resource_box."',

'".$resource_box_html."',

'".$keywords."',

'isnare',

'".$_SERVER['REMOTE_ADDR']."'

)") or die(mysql_error());