blocks|key|874625|text|非常简单：echo+str_replace('\'',+'\\\'',+$myString);然而，我建议使用JSON和json_encode()函数，因为它会更可靠(例如，引用新行)：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|874626|<?php+$data+=+array('myString'+=>+'...');+?>

<script>
+++var+phpData+=+<?php+echo+json_encode($data)+?>;
+++alert(phpData.myString);
</script>|code-block|syntax|javascript|874627|entityMap|0|LINK|mutability|MUTABLE|url|http://pl.wikipedia.org/wiki/JSON|1|http://pl.php.net/manual/en/function.json-encode.php^0|5|16|1O|D|1J|4|0|1O|D|1|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]|$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]|$9|12|A|13|1|14]]|E|$]]|$1|F|3|G|5|H|7|15|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|16|8|@]|D|@]|E|$]]]|L|$M|$5|N|O|P|E|$Q|R]]|S|$5|N|O|P|E|$Q|T]]]]

Quite simply: <code>echo str_replace('\'', '\\\'', $myString);</code>
However, I'd suggest use of <a href="http://pl.wikipedia.org/wiki/JSON" rel="noreferrer">JSON</a> and <a href="http://pl.php.net/manual/en/function.json-encode.php" rel="noreferrer"><code>json_encode()</code></a> function as it will be more reliable (quotes new lines for instance):

<pre><code>&lt;?php $data = array('myString' =&gt; '...'); ?&gt;

&lt;script&gt;
 var phpData = &lt;?php echo json_encode($data) ?&gt;;
 alert(phpData.myString);
&lt;/script&gt;
</code></pre>

blocks|key|657688|text|如果您想使用\对字符进行转义，您可以使用addcslashes()。例如，如果您想要像问题一样只转义单引号，您可以这样做：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|657689|echo+addcslashes($value,+"'");|code-block|syntax|javascript|657690|如果您想转义'、"、\和nul+(字节为空)，则可以使用addslashes()|657691|echo+addslashes($value);|657692|entityMap^0|6|1|K|D|0|0|6|1|8|1|A|1|C|3|S|C|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]|$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|M|3|N|5|H|7|17|8|@]|D|@]|E|$I|J]]|$1|O|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|P|$]]

If you want to escape characters with a <code>\</code>, you have <code>addcslashes()</code>. For example, if you want to escape only single quotes like the question, you can do:

<pre><code>echo addcslashes($value, "'");
</code></pre>

And if you want to escape <code>'</code>, <code>"</code>, <code>\</code>, and <code>nul</code> (the byte null), you can use <code>addslashes()</code>:

<pre><code>echo addslashes($value);
</code></pre>

blocks|key|657338|text|str_replace("'",+"\'",+$mystringWithSingleQuotes);|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|657339|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>str_replace("'", "\'", $mystringWithSingleQuotes);
</code></pre>

blocks|key|874760|text|在某些情况下，我只是将其转换为实体：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|874761|++++++++++++++++++++++++//+i.e.,++$x=+ABC\DEFGH'IJKL
$x+=+str_ireplace("'",++"&apos;",+$x);
$x+=+str_ireplace("\\",+"&bsol;",+$x);
$x+=+str_ireplace('"',++"&quot;",+$x);|code-block|syntax|javascript|874762|在HTML页面上，视觉输出是相同的：|874763|ABC\DEFGH'IJKL|874764|然而，它在源代码上是经过净化的。|874765|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

In some cases, I just convert it into ENTITIES:

<pre><code> // i.e., $x= ABC\DEFGH'IJKL
$x = str_ireplace("'", "&amp;apos;", $x);
$x = str_ireplace("\\", "&amp;bsol;", $x);
$x = str_ireplace('"', "&amp;quot;", $x);
</code></pre>

On the HTML page, the visual output is the same:

<pre><code>ABC\DEFGH'IJKL
</code></pre>

However, it is sanitized in source.

blocks|key|657369|text|要仅替换单引号，请使用以下简单语句：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|657370|$string+=+str_replace("'",+"\\'",+$string);|code-block|syntax|javascript|657371|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

To replace only single quotes, use this simple statement:

<pre><code>$string = str_replace("'", "\\'", $string);
</code></pre>

blocks|key|657750|text|您可以使用addcslashes函数来完成此操作，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|657751|echo+addcslashes($text,+"'\\");|code-block|syntax|javascript|657752|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.addcslashes.php^0|5|B|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

You can use the <a href="http://php.net/manual/en/function.addcslashes.php" rel="nofollow noreferrer">addcslashes</a> function to get this done like so:

<pre><code>echo addcslashes($text, "'\\");
</code></pre>

blocks|key|657450|text|我不确定您到底在对您的数据做什么，但您可以尝试：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|657451|$string+=+str_replace("'",+"%2527",+$string);|code-block|syntax|javascript|657452|每当字符串被发送到数据库进行存储时，我都会使用它。|657453|%2527是‘字符的编码，如果发送到服务器的字符串中包含单个'字符，它还有助于防止GET请求中断。我会在JavaScript和PHP中将‘替换为%2527，以防有人试图手动向你的PHP函数发送一些数据。|offset|length|style|CODE|657454|为了让它对最终用户更漂亮，只需对从服务器返回的所有数据运行反向替换函数，并将所有%2527个子字符串替换为'。|657455|快乐的注入避免！|657456|entityMap^0|0|0|0|S|1|0|1F|1|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|X|8|@$K|Y|L|Z|M|N]]|9|@]|A|$]]|$1|O|3|P|5|6|7|10|8|@$K|11|L|12|M|N]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|13|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|T|$]]

I am not sure what exactly you are doing with your data, but you could always try:

<pre><code>$string = str_replace("'", "%27", $string);
</code></pre>

I use this whenever strings are sent to a database for storage.

%27 is the encoding for the ' character, and it also helps to prevent disruption of GET requests if a single <code>'</code> character is contained in a string sent to your server. I would replace ' with %27 in both JavaScript and PHP just in case someone tries to manually send some data to your PHP function.

To make it prettier to your end user, just run an inverse replace function for all data you get back from your server and replace all %27 substrings with <code>'</code>.

Happy injection avoiding!

blocks|key|874689|text|这就是我是如何做到的。很傻，但很简单。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|874690|$singlequote+=+"'";
$picturefile+=+getProductPicture($id);

echo+showPicture('.$singlequote.$picturefile.$singlequote.');|code-block|syntax|javascript|874691|我的工作是输出调用JavaScript代码来显示图片的超文本标记语言……|874692|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Here is how I did it. Silly, but simple.

<pre><code>$singlequote = "'";
$picturefile = getProductPicture($id);

echo showPicture('.$singlequote.$picturefile.$singlequote.');
</code></pre>

I was working on outputting HTML that called JavaScript code to show a picture...

blocks|key|874849|text|我写了下面的函数。它取代了以下内容：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|874850|单引号“带有斜杠和单引号\”。|874851|带有两个反斜杠的反斜杠[]+\|874852|function+escapePhpString($target)+{
++++$replacements+=+array(
++++++++++++"'"+=>+'\\\'',
++++++++++++"\\"+=>+'\\\\'
++++);
++++return+strtr($target,+$replacements);
}|code-block|syntax|javascript|874853|您可以修改它以在$replacements数组中添加或删除字符替换。例如，为了替换\r\n，它变成了"\r\n“=>+"\r\n”和"\n“=>+"\n”。|874854|/**
+*+With+new+line+replacements+too
+*/
function+escapePhpString($target)+{
++++$replacements+=+array(
++++++++++++"'"+=>+'\\\'',
++++++++++++"\\"+=>+'\\\\',
++++++++++++"\r\n"+=>+"\\r\\n",
++++++++++++"\n"+=>+"\\n"
++++);
++++return+strtr($target,+$replacements);
}|874855|strtr的巧妙之处在于，它更喜欢长替换。|874856|例如，“Cool+\r\n+nFeature”将转义\r+\n而不是转义\n。|874857|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|X|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|Y|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|Z|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|10|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|T|$]]

I wrote the following function. It replaces the following:

Single quote ['] with a slash and a single quote [\'].

Backslash [\] with two backslashes [\\]

<pre><code>function escapePhpString($target) {
 $replacements = array(
 "'" =&gt; '\\\'',
 "\\" =&gt; '\\\\'
 );
 return strtr($target, $replacements);
}
</code></pre>

You can modify it to add or remove character replacements in the $replacements array. For example, to replace \r\n, it becomes "\r\n" => "\r\n" and "\n" => "\n".

<pre><code>/**
 * With new line replacements too
 */
function escapePhpString($target) {
 $replacements = array(
 "'" =&gt; '\\\'',
 "\\" =&gt; '\\\\',
 "\r\n" =&gt; "\\r\\n",
 "\n" =&gt; "\\n"
 );
 return strtr($target, $replacements);
}
</code></pre>

The neat feature about strtr is that it will prefer long replacements.

Example, "Cool\r\nFeature" will escape \r\n rather than escaping \n along.

I am writing some JavaScript code that uses a string rendered with PHP. How can I escape single quotes (and only single quotes) in my PHP string?

<pre><code>&lt;script type="text/javascript"&gt;
 $('#myElement').html('say hello to &lt;?php echo $mystringWithSingleQuotes ?&gt;');
&lt;/script&gt;
</code></pre>

How do I escape only single quotes?

数据库

服务器

我正在编写一些JavaScript代码，它使用用PHP呈现的字符串。如何转义PHP字符串中的单引号(并且只转义单引号)？<script type="text/javascript"> $('#myElement').html('say hello to <?php echo $mystringWithSingleQuotes ?>');</script>

问如何仅转义单引号？
EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何仅转义单引号？EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何仅转义单引号？
EN