php过滤特殊字符mysql攻击_php – MySQL在特殊字符处切断字符串

我正在尝试使用

PHP将远程POST数据(iSnare发送的文章)插入MySQL.数据来自远程POST发件人,我可以将其写入纯文本文件而不会出现问题.

不幸的是,当它将它插入MySQL时,MySQL会在特殊字符处切断字符串(文章).我尝试过很多东西,但我还是不成功！

我试过了：

>使用mysql_real_escape_string()转义字符

>使用htmlentities()和htmlspecialchars()(包含每个参数..)

>在执行其他所有操作之前,将SET NAMES utf8查询发送到MySQL

>所有表和列都是UTF-8编码和utf8_general_ci(也尝试了utf8_unicode_ci和utf8_bin作为整理)

>将所有PHP文件保存为UTF-8

我仍然找不到解决方案.如果有人能帮助我解决这个问题,我将非常感激.

这是我的表定义和PHP代码：

PHP

function guvenlik_sql($x){

// Cleans inputs agains sql injection

return mysql_real_escape_string(htmlentities(stripslashes($x)), ENT_QUOTES);

}

// Check if data really comes from an Isnare.com server (Address hidden)

if ($_SERVER['REMOTE_ADDR'] == $isnareIP || $_SERVER['REMOTE_ADDR'] == "xxx.xxx.xxx.xxx") {

$title = guvenlik_sql($_POST["article_title"]);

$first_name = guvenlik_sql($_POST["article_author"]);

$description = guvenlik_sql($_POST["article_summary"]);

$category = guvenlik_sql($_POST["article_category"]);

$article = guvenlik_sql($_REQUEST["article_body_text"]);

$article_html = guvenlik_sql($_POST["article_body_html"]);

$resource_box = guvenlik_sql($_POST["article_bio_text"]);

$resource_box_html = guvenlik_sql($_POST["article_bio_html"]);

$keywords = guvenlik_sql($_POST["article_keywords"]);

$email = guvenlik_sql($_POST["article_email"]);

$fp = fopen('test.txt', 'a');

fwrite($fp, $title."\n");

fwrite($fp, $article."\n\n\n\n");

fclose($fp);

mysql_query("INSERT INTO articles " .

"(" .

"first_name, " .

"email, " .

"title, " .

"description, " .

"article, " .

"article_html, " .

"category, " .

"resource_box, " .

"resource_box_html, " .

"keywords, " .

"distributor, " .

"distributor_host" .

") VALUES (" .

"'$first_name', " .

"'$email', " .

"'$title', " .

"'$description', " .

"'$article', " .

"'$article_html', " .

"'$category', " .

"'$resource_box', " .

"'$resource_box_html', " .

"'$keywords', " .

"'$isnare', " .

"'$_SERVER['REMOTE_ADDR']', " .

")") or die(mysql_error());

} //end if security

表定义

CREATE TABLE `articles` (

`article_ID` int(11) NOT NULL auto_increment,

`first_name` varchar(100) NOT NULL,

`last_name` varchar(100) NOT NULL,

`email` varchar(100) NOT NULL,

`password` varchar(100) NOT NULL,

`author_url` varchar(255) NOT NULL,

`company_name` varchar(100) NOT NULL,

`address1` varchar(100) NOT NULL,

`address2` varchar(100) NOT NULL,

`state_2digit` varchar(100) NOT NULL,

`state` varchar(100) NOT NULL,

`zip_code` varchar(100) NOT NULL,

`country` varchar(100) NOT NULL,

`phone` varchar(100) NOT NULL,

`newsletter` varchar(100) NOT NULL,

`title` varchar(255) NOT NULL,

`description` text NOT NULL,

`article` longtext NOT NULL,

`article_html` longtext NOT NULL,

`category` varchar(100) NOT NULL,

`cat` varchar(100) NOT NULL,

`resource_box` text NOT NULL,

`resource_box_html` longtext NOT NULL,

`keywords` varchar(255) NOT NULL,

`publish_date` timestamp NOT NULL default CURRENT_TIMESTAMP,

`distributor` varchar(255) NOT NULL default '',

`distributor_host` varchar(255) NOT NULL,

PRIMARY KEY (`article_ID`)

) ENGINE=InnoDB DEFAULT CHARSET=utf8 CHECKSUM=1 DELAY_KEY_WRITE=1 ROW_FORMAT=DYNAMIC