为什么我收到mysql_real_escape_string()警告？

Question

我有这个代码将目录中的文件名插入数据库

<?php
include("db.php");

 $path = 'C:\Users\Firdavs\Desktop\Ypp';
 $directories = new RecursiveIteratorIterator(
    new ParentIterator(new RecursiveDirectoryIterator($path)), 
    RecursiveIteratorIterator::SELF_FIRST);

foreach ($directories as $directory) {
        if($directory->isDir())
          {
             foreach (new DirectoryIterator($directory) as $file)
              {
                if($file->isDot()) continue;
                if($file->isFile())
                  {
                     $filename=$file->getFilename();
                      $ext = pathinfo($filename, PATHINFO_EXTENSION);
                      if($ext=='docx')
                      {
                         mysqli_query($con,"INSERT INTO Organ (Name) VALUES ('$filename')");
                         $filename=mysql_real_escape_string($filename);
                      }

                  }
              }

          }
}

?>

它显示警告如下

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user ''@'localhost' (using password: NO) in Y:\home\localhost\www\jurist\import.php on line 22

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in Y:\home\localhost\www\jurist\import.php on line 22

但代码仍然有效,将文件名插入数据库;

我的db.php正在关注

$con= mysqli_connect("localhost","root","mypassword","jurist") or die("Error " . mysqli_error($con));

可能是什么问题？

Answer 1

你在这里混合mysql_*和mysqli_函数$filename=mysql_real_escape_string($filename);.

没有与数据库的mysql_连接,这就是您收到此错误的原因.这就是你应该做的

$filename = mysqli_real_escape_string($con, $filename);
mysqli_query($con,"INSERT INTO Organ (Name) VALUES ('$filename')");

另外......插入它之后逃脱字符串是没有用的.无论你使用什么数据库api.