在mysql_real_escape_string中苦苦挣扎

Question

谁能帮忙.我正在尝试使用mysql_real_escape_string支持传递给PHP的内部消息传递服务的值,但我必须在某处获取语法错误,因为这些值没有插入到数据库中.我四处寻找教程,帮助等,但努力做到正确.

我正在使用的代码如下.正确输入未转义的值($ email,$ from,$ time),但其他值只是输入空白.

<?php
session_start();
$conn = mysqli_connect('localhost', 'username', 'password', 'dbname');

$email=$_SESSION['email'];
$to = $_POST ['touser'];
$toemail = $_POST['touseremail'];
$from = $_SESSION['name'];
$message = $_POST['message'];
$subject = $_POST['subject'];
$time = time();

$query ="INSERT INTO messages
(to_user, to_email, subject, message, from_user, from_email, daterecord)
VALUES (
'" . mysql_real_escape_string($conn, $to) . "', 
'" . mysql_real_escape_string($conn, $toemail) . "', 
'" . mysql_real_escape_string($conn, $subject) . "', 
'" . mysql_real_escape_string($conn, $message) . "', 
'$from', '$email', '$time')";
$send = $conn -> query($query);

echo "Message sent!";

?>

Answer 1

看看函数mysqli_real_escape_string()

我还应该注意,现在最好的转义字符串的方法是参数绑定