在sql表中插入html

Question

我正在尝试在我的sql表中插入一个值,其中包含html:如下所示

<?
$story ="<div class='post'><p class='date'>$mont<b>$day</b></p><h2    class='title'>lkjljt</h2><p class='meta'><small>Posted $name | $school, $date | Rating</small></p><div class='entry'>$message</div></div>";

$db = mysql_connect("host", "user", "password"); 
mysql_select_db("db", $db); 

 if (!$db)
  {
  die('Could not connect: ' . mysql_error());
  }

 $sql = "INSERT INTO Post VALUES ('', '$date', '$time', '$story',  '$school','$location', '$sex', '$zipcode', '$name');";

 $result = mysql_query($sql);


 if($result)
 { $success = " Your hookup has been submitted ";}
 else{
  $error = "something went horribly wrong" . mysql_error();}



 ?>

当我提交此页面时,我不断收到语法错误,如果我评论$ story,则查询运行正常.我怎样才能解决这个问题？

Answer 1

最可能的原因是$ story包含单引号,这会破坏查询.使用mysql_real_escape_string保护它

一般来说,这是一个坏主意,因为它对SQL注入是开放的.

$sql = "INSERT INTO Post VALUES ('', '$date', '$time', '$story',
       '$school','$location', '$sex', '$zipcode', '$name');";

至少,使用mysql_real_escape_string,它将保护MySQL查询中具有特殊含义的字符的输入.在所有文本列上使用它.

$sql = "INSERT INTO Post VALUES ('', '$date', '$time', '" .
       mysql_real_escape_string($story) . "','".
       mysql_real_escape_string($school) . "','".
       mysql_real_escape_string($location) . "', '$sex', '$zipcode', '" .
       mysql_real_escape_string($name) ."');";