在php中转义单引号mysql查询 - Escape single quote mysql query in php

Escape single quote mysql query in php

本文关键字：mysql 查询单引号转义 php | 更新日期: 2023-09-27

我有以下查询:

$query = 'UPDATE #__k2_items 
          SET extra_fields='''.$campos_extra_updated.''' 
          WHERE id='.$item_id;

$campos_extra_updated包含以下值，在尝试转义引号之前，我能够使用不同的查询检索该值:

UPDATE ikyfb_k2_items SET extra_fields = "[{"id":"2","value":"Ser mayor de edad"},
{"id":"3","value":"asdf"},{"id":"4","value":9999998},{"id":"5","value":"10"},
{"id":"6","value":"7"},{"id":"7","value":"3"},{"id":"8","value":"1"},
{"id":"9","value":"2014-05-28"},{"id":"10","value":"2014-05-30"},
{"id":"11","value":"2014-05-28"},{"id":"12","value":"2014-05-31"},{"id":"14","value":"25"},{"id":"15","value":"20"},{"id":"16","value":"Consigue descuento ahora!"},
{"id":"17","value":"123abc"}]" WHERE id=52

在SET extra_fields =之后和{"id":"17","value":"123abc"}]的末尾，双撇号应该是单引号，以便查询工作。

我做错了什么?我也试过使用mysql_real_escape_string，它似乎不起作用。

我用下面的方法解决了这个问题:

$query = 'UPDATE #__k2_items 
          SET extra_fields='''.mysql_real_escape_string($campos_extra_updated).''' 
          WHERE id='.$item_id;