PHP：在PDO之前處理引號exec

Question

我有一個我設計的表單，我的意圖是接受任何UTF-8內容並將其插入MySQL數據庫。我用charset utf-8作爲連接數據庫的編碼來使用PDO。當內容包含單引號等字符時，插入查詢仍然失敗。在查詢中使用它之前，我應該在輸入內容中使用哪些內置函數。下面是剛剛被插入到數據庫

INSERT INTO dbname.table 
       (input_xml) 
      VALUES 
       ('<?xml version="1.0" encoding="UTF-8" standalone="yes" ?> 
      <ip_Input> 
       <ip_xml> 
        Qaiku.com – What Can We 
        Learn From Failure?By Guest Blogger, September 11, 2012, Leave a 
        CommentEditor's note: I think we in the tech press have the tendency to 
        focus on the positive stories and forget about the startups that didn't live up 
        their expectations. Our Sofanatics coverage this past week has been one of the 
        few times we've covered abandoned projects, which is a pitty because there are a 
        lot to learn from "failures." Below we have a long read from Eero Holmila which 
        is one part eulogy, and another part what he's learned from the now-announced 
        shutdown of Qaiku.com.Qaiku.com might be a familiar name for some of the 
        readers of Arctic Startup. However, I am quite sure that the background and the 
        rough road from high hopes to a bitter decline probably is not. I am the CEO of 
        Rohea, a company behind a handful of quite successful Finnish websites like 
        Kotikokki.net, Kuvake.net, Mikseri.net and of course a less successful 
        Qaiku.com.I am going to share some lessons learned through the trip. I hope 
        some of it might be of use, spark up ideas or if nothing else, be at least a bit 
        entertaining. One last important disclaimer: all the opinions are my own.Now 
        without further delay, this is the story of 
        Qaiku. 
       </ip_xml> 
      </ip_Input> 
       '); 

Answer 1

你應該使用功能是PDOStatement::bindValue()之前形成的示例查詢。在此之前，您還應該閱讀SQL注入以及使用帶參數化查詢的PDO的正確方法。