小编Den*_*973的帖子

什么时候使用以下代码没有mysql_real_escape_string,工作正常.我只是试图抓住可能有背道的文本字符串.从输入表单并格式化它放入mysql表.

    <?php
    $filenamee = $_FILES["file"]["name"];
    $filename =strval($filenamee);
    echo "file name is".$filename;

     $con=mysqli_connect("localhost","blasbott_admin","lubu1973","blasbott_upload");
     // Check connection
     if (mysqli_connect_errno())
       {
   echo "Failed to connect to MySQL: " . mysqli_connect_error();
   }
 $companyName = mysql_real_escape_string($_POST['companyName']);
// $companyName = mysql_real_escape_string($companyNamee);
 //$companyName = mysql_real_escape_string($companyNamee);

$sql="INSERT INTO ads (companyName, webSite, picture)
 VALUES ('$companyName','$_POST[webSite]','$filename')";

if (!mysqli_query($con,$sql))
   {
   die('Error: ' . mysqli_error($con));
   }
   echo"<br>";
 echo "1 record added";

mysqli_close($con);
 ?>