如何在magento中逃脱mysql？

Question

我想在magento中逃避字符串,但是当我使用时mysql_real_escape_string,我正在收到警告.

警告:mysql_real_escape_string()[function.mysql-real-escape-string]:无法通过套接字'/var/lib/mysql/mysql.soc .....连接到本地MySQL服务器

我找不到任何magento的核心mysql转义函数.所以我该怎么做？

Answer 1

使用它来转义查询的字符串并添加周围的单引号:

Mage::getSingleton('core/resource')->getConnection('default_write')->quote($string);

Varien_Db_Adapter_Pdo_Mysql如果需要,您可以查找更多报价详细信息.

Answer 2

我认为Magento使用基于PDO的DB Access层,如果您使用绑定参数,它将自动处理转义.使用Magento方法编写插入查询的示例,注意SQL注入

$write = Mage::getSingleton("core/resource")->getConnection("core_write");

// Concatenated with . for readability
$query = "insert into mage_example "
       . "(name, email, company, description, status, date) values "
       . "(:name, :email, :company, :desc, 0, NOW())";

$binds = array(
    'name'    => "name' or 1=1",
    'email'   => "email",
    'company' => "company",
    'desc'    => "desc",
);
$write->query($query, $binds);