如何在PHP中使用单引号(')来破坏字符串？

Question

这是我的代码:

   $newMsg="chinu debasish bitto deba prince's";

    //$curTime=date('G');
    //if(($curTime >= 9) || ($curTime < 21)){
        $chkUname=explode(" ",$newMsg);
        echo "SELECT mobile_hash FROM ".CHAT_USER." WHERE username IN(".implode(",",$chkUname).")";
    //}

以上代码我得到:

SELECT mobile_hash
FROM chat_users WHERE username IN(chinu,debasish,bitto,deba)

但我希望每个字符串都带有单引号,如:

SELECT mobile_hash
FROM chat_users WHERE username IN('chinu','debasish','bitto','deba') 

编辑:这个问题不重复请再次检查我的问题并格式化PHP数组的SQL"IN"子句

Answer 1

使用implode构建格式化的查询字符串值.因为你的字符串中有一个撇号,所以你必须转义它以产生错误和SQL注入攻击免费查询.

$imp = "'" . implode( "','", mysql_escape_string($chkUname) ) . "'";

echo "SELECT mobile_hash FROM ".CHAT_USER." WHERE username IN($imp)";