mysql_real_escape_string无效

Question

我的mysql_real_escape_string被忽略了.它杀了我,因为我觉得这是我想念的小事.

$ htmlText变量来自TinyMCE编辑器,其中文本呈现为HTML,即带有标签等.

<?php 
    /*--------GLOBAL PROCEDURES--------*/
    session_start();
    require "../scr/config-data.php.inc";
    mysql_connect($host,$username,$password) or die 
    ("Could Not Connect".mysql_error());
    mysql_select_db($db) or die ("Could Not Connect".mysql_error());

    /*-----SEVERAL SELECT/INSERT QUERIES, ALL WORKING FINE-----*/

    /*--------SPECIFIC PROCEDURES-------*/      
    if($_POST['submit']){
        //Check that POS has been chosen
        $htmlText = mysql_real_escape_string($_POST['cust']);
        if($htmlText != ""){
            mysql_query("INSERT INTO table VALUES(NULL, '$htmlText' )") or die(mysql_error());
        }else{
            $feedback = "Please Enter some text into the editor";
        }
    }

    /*--------CLOSING PROCEDURES-------*/
    mysql_close();

?>

奇怪的是,它是从一个有效的脚本改编而来,只改变了变量名.我在MySQL语法中遇到错误.它也没有转义文本中的HTML,所以我收到此错误:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order VALUES(NULL, '

sfgafgafs

')' at line 1

Answer 1

从您给出的错误消息看起来您正在使用order的表名恰好是MySQL保留字.

尝试将其封闭在后面的刻度中.