blocks|key|1926801|text|对于转义，mysql_real_escape_string函数是此任务的通常选择，除非它确实需要连接。另一种选择是addslashes。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1926802|我会签出一个mysqldump文件，其中包含所需的参数(字符集、drop+tables等)。并以此为起点。|1926803|entityMap^0|5|O|1L|A|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

For escaping, <code>mysql_real_escape_string</code> function is the usual choice for this task except it does need a connection. The other alternative would be <code>addslashes</code>. 

I would check out a mysqldump file tailored with the needed paramaters (character sets, drop tables, etc ..) and take it from there as a starting point.

blocks|key|1926827|text|@stefgosselin:+mysql_real_escape_string确实需要一个连接。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1926828|我会用最少的阻力走这条线。表示使用系统调用来执行mysqldumper+>+tmpfile|1926829|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

@stefgosselin:
mysql_real_escape_string did require a connection.

I would go the line with least resistance. Means use a systemcall to exec mysqldumper > tmpfile

blocks|key|1926858|text|这只是一个想法，有没有可能让你的应用程序生成和sql|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1926859|INSERT+INTO+table1+(id,+name)+VALUES+(?,+?);|code-block|syntax|javascript|1926860|并将sql的一组参数作为数组传递|1926861|$parms+=+array('value1',+'value2');|1926862|然后让应用程序中执行数据库工作的部分在这一点上进行转义|1926863|function+writeToDb($sql,+$parms)+{
//+do+escaping+here
}|1926864|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

just a thought, is it possible for you app to generate and sql like

<pre><code>INSERT INTO table1 (id, name) VALUES (?, ?);
</code></pre>

and pass a set of paramaters for the sql as an array

<pre><code>$parms = array('value1', 'value2');
</code></pre>

and then have the part of your app that does do database work do the escaping at that point

<pre><code>function writeToDb($sql, $parms) {
// do escaping here
}
</code></pre>

blocks|key|306778|text|MySQL函数需要连接才能转义字符串的原因是，mysql_real_escape_string()所做的一切就是调用MySQL的内置转义函数。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|306779|但是，如果您阅读the+manual+page+for+it，您将看到它们确实列出了转义的字符：|306780|306781|+mysql_real_escape_string()调用MySQL的库函数mysql_real_escape_string，该函数将反斜杠添加到以下字符前面：\x00、\n、\r、\、‘、“和\x1a。|blockquote|306782|306783|306784|您不希望使用addslashes()，因为它只转义了几个字符，并且不能提供安全的解决方案。但是您应该能够使用给定的字符列表，通过对strtr()或类似的简单调用，重新实现mysql_real_escape_string()所做的转义：|306785|$replacements+=+array("\x00"=>'\x00',
++++++++++++++++++++++"\n"=>'\n',
++++++++++++++++++++++"\r"=>'\r',
++++++++++++++++++++++"\\"=>'\\\\',
++++++++++++++++++++++"'"=>"\'",
++++++++++++++++++++++'"'=>'\"',
++++++++++++++++++++++"\x1a"=>'\x1a');
$escaped+=+strtr($unescaped,$replacements);|code-block|syntax|javascript|306786|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/mysql_real_escape_string|1|2|http://php.net/manual/en/function.strtr.php^0|N|Q|N|Q|0|0|8|M|1|0|0|0|0|0|6|C|1T|7|2D|Q|1T|7|2|0|0^^$0|@$1|2|3|4|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@$9|18|A|19|1|1A]]|E|$]]|$1|F|3|G|5|6|7|1B|8|@]|D|@$9|1C|A|1D|1|1E]]|E|$]]|$1|H|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]|$1|I|3|J|5|K|7|1G|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|1H|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|1J|8|@$9|1K|A|1L|B|C]|$9|1M|A|1N|B|C]|$9|1O|A|1P|B|C]]|D|@$9|1Q|A|1R|1|1S]]|E|$]]|$1|P|3|Q|5|R|7|1T|8|@]|D|@]|E|$S|T]]|$1|U|3|-4|5|6|7|1U|8|@]|D|@]|E|$]]]|V|$W|$5|X|Y|Z|E|$10|11]]|12|$5|X|Y|Z|E|$10|11]]|13|$5|X|Y|Z|E|$10|14]]]]

The reason the MySQL functions require a connection in order to escape the string is that all <a href="http://php.net/mysql_real_escape_string" rel="nofollow"><code>mysql_real_escape_string()</code></a> does is make a call to MySQL's built-in escaping function.

However, if you read <a href="http://php.net/mysql_real_escape_string" rel="nofollow">the manual page for it</a>, you'll see that they do list the characters which are escaped:

<blockquote>
 mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.
</blockquote>

You don't want to use <code>addslashes()</code> since that only escapes a few characters, and would not provide a secure solution. But you should be able to re-implement the escaping done by <code>mysql_real_escape_string()</code> using the list of characters given, with a simple call to <a href="http://php.net/manual/en/function.strtr.php" rel="nofollow"><code>strtr()</code></a> or similar:

<pre><code>$replacements = array("\x00"=&gt;'\x00',
 "\n"=&gt;'\n',
 "\r"=&gt;'\r',
 "\\"=&gt;'\\\\',
 "'"=&gt;"\'",
 '"'=&gt;'\"',
 "\x1a"=&gt;'\x1a');
$escaped = strtr($unescaped,$replacements);
</code></pre>

I'm writing an export tool that converts input json data to sql statements.

This tool is (and should not) be aware of database connections, it should just output a .sql that can be used with other tools do the actual import.

Most of the mysqli->* and PDO-related functions rely on an open connection (to determine things like the characterset). What's a good way to go about this?

Exporting data to a .sql format. How to escape?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在编写一个导出工具，用于将输入的json数据转换为sql语句。这个工具是(也不应该)知道数据库连接的，它应该只是输出一个可以与其他工具一起使用的.sql来做实际的导入。大多数mysqli->*和PDO相关函数都依赖于一个开放的连接(来确定字符集之类的东西)。做这件事的好方法是什么？

问将数据导出为.sql格式。如何逃脱？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将数据导出为.sql格式。如何逃脱？EN