blocks|key|1406198|text|你可以查一下PDO+Library。您可以将准备好的语句与PDO一起使用，如果正确使用准备好的语句，PDO将自动转义字符串中的任何错误字符。我想这只适用于PHP5。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1406199|entityMap|0|LINK|mutability|MUTABLE|url|http://au.php.net/pdo^0|6|B|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You could look into the <a href="http://au.php.net/pdo" rel="noreferrer">PDO Library</a>. You can use prepared statements with PDO, which will automatically escape any bad characters in your strings if you do the prepared statements correctly. This is for PHP 5 only I think.

blocks|key|1621028|text|addslashes()并不完全够用，但是PHP包并没有提供任何像样的替代方案。丑陋但完全通用的解决方案是将数据编码为十六进制字符串，即|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1621029|$unpacked+=+unpack('H*hex',+$data);
mssql_query('
++++INSERT+INTO+sometable+(somecolumn)
++++VALUES+(0x'+.+$unpacked['hex']+.+')
');|code-block|syntax|javascript|1621030|抽象地说，这将是：|1621031|function+mssql_escape($data)+{
++++if(is_numeric($data))
++++++++return+$data;
++++$unpacked+=+unpack('H*hex',+$data);
++++return+'0x'+.+$unpacked['hex'];
}

mssql_query('
++++INSERT+INTO+sometable+(somecolumn)
++++VALUES+('+.+mssql_escape($somevalue)+.+')
');|1621032|等同于mysql_error()的是mssql_get_last_message()。|1621033|entityMap^0|0|C|0|0|0|0|3|D|I|O|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|R|$]]

<code>addslashes()</code> isn't fully adequate, but PHP's mssql package doesn't provide any decent alternative. The ugly but fully general solution is encoding the data as a hex bytestring, i.e.

<pre><code>$unpacked = unpack('H*hex', $data);
mssql_query('
 INSERT INTO sometable (somecolumn)
 VALUES (0x' . $unpacked['hex'] . ')
');
</code></pre>

Abstracted, that would be:

<pre><code>function mssql_escape($data) {
 if(is_numeric($data))
 return $data;
 $unpacked = unpack('H*hex', $data);
 return '0x' . $unpacked['hex'];
}

mssql_query('
 INSERT INTO sometable (somecolumn)
 VALUES (' . mssql_escape($somevalue) . ')
');
</code></pre>

<code>mysql_error()</code> equivalent is <code>mssql_get_last_message()</code>.

blocks|key|1621098|text|您可以使用下面的正则表达式：[\000\010\011\012\015\032\042\047\134\140]来创建您自己的mysql_real_escape_string版本(并对其进行改进)。这将处理以下字符:空、退格键、水平制表符、换行符、回车符、替换符、双引号、单引号、反斜杠、重音。mysql_real_escape_string不支持退格键和水平制表符。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1621099|entityMap^0|E|16|1R|O|43|O|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|O|8|@]|D|@]|E|$]]]|G|$]]

You could roll your own version of <code>mysql_real_escape_string</code>, (and improve upon it) with the following regular expression: <code>[\000\010\011\012\015\032\042\047\134\140]</code>. That takes care of the following characters: null, backspace, horizontal tab, new line, carriage return, substitute, double quote, single quote, backslash, grave accent. Backspace and horizontal tab are not supported by <code>mysql_real_escape_string</code>.

blocks|key|1406353|text|function+ms_escape_string($data)+{
++++++++if+(+!isset($data)+or+empty($data)+)+return+'';
++++++++if+(+is_numeric($data)+)+return+$data;

++++++++$non_displayables+=+array(
++++++++++++'/%250[0-8bcef]/',++++++++++++//+url+encoded+00-08,+11,+12,+14,+15
++++++++++++'/%251[0-9a-f]/',+++++++++++++//+url+encoded+16-31
++++++++++++'/[\x00-\x08]/',++++++++++++//+00-08
++++++++++++'/\x0b/',+++++++++++++++++++//+11
++++++++++++'/\x0c/',+++++++++++++++++++//+12
++++++++++++'/[\x0e-\x1f]/'+++++++++++++//+14-31
++++++++);
++++++++foreach+(+$non_displayables+as+$regex+)
++++++++++++$data+=+preg_replace(+$regex,+'',+$data+);
++++++++$data+=+str_replace("'",+"''",+$data+);
++++++++return+$data;
++++}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1406354|这里的一些代码是从CodeIgniter中抄袭过来的。运行良好，是一个干净的解决方案。|unstyled|1406355|编辑:上面的代码片段有很多问题。请不要在没有阅读评论的情况下使用这篇文章，以了解它们是什么。更好的是，请不要使用这个。参数化查询是您的朋友：http://php.net/manual/en/pdo.prepared-statements.php|offset|length|1406356|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/pdo.prepared-statements.php^0|0|0|1Y|1G|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|T|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|F|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

<pre><code>function ms_escape_string($data) {
 if ( !isset($data) or empty($data) ) return '';
 if ( is_numeric($data) ) return $data;

 $non_displayables = array(
 '/%0[0-8bcef]/', // url encoded 00-08, 11, 12, 14, 15
 '/%1[0-9a-f]/', // url encoded 16-31
 '/[\x00-\x08]/', // 00-08
 '/\x0b/', // 11
 '/\x0c/', // 12
 '/[\x0e-\x1f]/' // 14-31
 );
 foreach ( $non_displayables as $regex )
 $data = preg_replace( $regex, '', $data );
 $data = str_replace("'", "''", $data );
 return $data;
 }
</code></pre>

Some of the code here was ripped off from CodeIgniter. Works well and is a clean solution.

EDIT:
There are plenty of issues with that code snippet above. Please don't use this without reading the comments to know what those are. Better yet, please don't use this at all. Parameterized queries are your friends: <a href="http://php.net/manual/en/pdo.prepared-statements.php" rel="nofollow noreferrer">http://php.net/manual/en/pdo.prepared-statements.php</a>

blocks|key|1406406|text|为了转义单引号和双引号，您必须将它们加倍：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1406407|$value+=+'This+is+a+quote,+"I+said,+'Hi'"';

$value+=+str_replace(+"'",+"''",+$value+);+|code-block|syntax|javascript|1406408|$value+=+str_replace(+'"',+'""',+$value+);|offset|length|style|CODE|1406409|$query+=+"INSERT+INTO+TableName+(+TextFieldName+)+VALUES+(+'$value'+)+";|1406410|等等。|1406411|和归因：Escape+Character+In+Microsoft+SQL+Server+2000|1406412|entityMap|0|LINK|mutability|MUTABLE|url|http://tipsandtricks.nogoodatcoding.com/2007/07/escape-character-in-microsoft-sql.html^0|0|0|0|16|0|0|0|4|19|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|11|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|12|8|@$I|13|J|14|K|L]]|9|@]|A|$]]|$1|M|3|N|5|D|7|15|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|16|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|17|8|@]|9|@$I|18|J|19|1|1A]]|A|$]]|$1|S|3|-4|5|6|7|1B|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z]]]]

In order to escape single- and double-quotes, you have to double them up:

<pre><code>$value = 'This is a quote, "I said, 'Hi'"';

$value = str_replace( "'", "''", $value ); 
</code></pre>

<code>$value = str_replace( '"', '""', $value );</code> 

<pre><code>$query = "INSERT INTO TableName ( TextFieldName ) VALUES ( '$value' ) ";
</code></pre>

etc...

and attribution: <a href="http://tipsandtricks.nogoodatcoding.com/2007/07/escape-character-in-microsoft-sql.html" rel="nofollow">Escape Character In Microsoft SQL Server 2000</a>

blocks|key|1621222|text|处理单引号和双引号的另一种方法是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1621223|function+mssql_escape($str)
{
++++if(get_magic_quotes_gpc())
++++{
++++++++$str+=+stripslashes($str);
++++}
++++return+str_replace("'",+"''",+$str);
}|code-block|syntax|javascript|1621224|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Another way to handle single and double quotes is:

<pre><code>function mssql_escape($str)
{
 if(get_magic_quotes_gpc())
 {
 $str = stripslashes($str);
 }
 return str_replace("'", "''", $str);
}
</code></pre>

blocks|key|1406594|text|既然可以在查询中使用参数，为什么还要转义任何东西呢？！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1406595|sqlsrv_query(
++++$connection,+
++++'UPDATE+some_table+SET+some_field+=+?+WHERE+other_field+=+?',+
++++array($_REQUEST['some_field'],+$_REQUEST['id'])
)|code-block|syntax|javascript|1406596|无论你的values参数是否为null，它都可以正确地选择、删除、更新。做一个原则问题-不要连接SQL，你总是安全的，你的查询读起来更好。|offset|length|style|CODE|1406597|http://php.net/manual/en/function.sqlsrv-query.php|1406598|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|F|4|0|0|1E|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|W|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|X|8|@$I|Y|J|Z|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|10|8|@]|9|@$I|11|J|12|1|13]]|A|$]]|$1|O|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|N]]]]

Why would you bother escaping anything when you can use parameters in your query?!

<pre><code>sqlsrv_query(
 $connection, 
 'UPDATE some_table SET some_field = ? WHERE other_field = ?', 
 array($_REQUEST['some_field'], $_REQUEST['id'])
)
</code></pre>

It works right in selects, deletes, updates regardless whether your values parameters are <code>null</code> or not.
Make a matter of principle - Don't concatenate SQL and you are always safe and your queries read much better. 

<a href="http://php.net/manual/en/function.sqlsrv-query.php" rel="noreferrer">http://php.net/manual/en/function.sqlsrv-query.php</a>

blocks|key|1621465|text|如果您使用的是PDO，则可以使用PDO::quote方法。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1621466|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/pdo.quote.php^0|G|A|G|A|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

If you are using PDO, you can use the <a href="http://php.net/manual/en/pdo.quote.php" rel="nofollow"><code>PDO::quote</code></a> method.

blocks|key|1406691|text|我一直在使用它作为mysql_real_escape_string()的替代方案|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1406692|function+htmlsan($htmlsanitize){
++++return+$htmlsanitize+=+htmlspecialchars($htmlsanitize,+ENT_QUOTES,+'UTF-8');
}
$data+=+"Whatever+the+value's+is";
$data+=+stripslashes(htmlsan($data));|code-block|syntax|javascript|1406693|entityMap^0|9|Q|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

I have been using this as an alternative of <code>mysql_real_escape_string()</code>:

<pre><code>function htmlsan($htmlsanitize){
 return $htmlsanitize = htmlspecialchars($htmlsanitize, ENT_QUOTES, 'UTF-8');
}
$data = "Whatever the value's is";
$data = stripslashes(htmlsan($data));
</code></pre>

blocks|key|1621583|text|最好也对SQL保留字进行转义。例如：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1621584|function+ms_escape_string($data)+{
++++if+(!isset($data)+or+empty($data))
++++++++return+'';

++++if+(is_numeric($data))
++++++++return+$data;

++++$non_displayables+=+array(
++++++++'/%250[0-8bcef]/',++++++++//+URL+encoded+00-08,+11,+12,+14,+15
++++++++'/%251[0-9a-f]/',+++++++++//+url+encoded+16-31
++++++++'/[\x00-\x08]/',++++++++//+00-08
++++++++'/\x0b/',+++++++++++++++//+11
++++++++'/\x0c/',+++++++++++++++//+12
++++++++'/[\x0e-\x1f]/',++++++++//+14-31
++++++++'/\27/'
++++);
++++foreach+($non_displayables+as+$regex)
++++++++$data+=+preg_replace(+$regex,+'',+$data);
++++$reemplazar+=+array('"',+"'",+'=');
++++$data+=+str_replace($reemplazar,+"*",+$data);
++++return+$data;
}|code-block|syntax|javascript|1621585|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

It is better to also escape SQL reserved words. For example:

<pre><code>function ms_escape_string($data) {
 if (!isset($data) or empty($data))
 return '';

 if (is_numeric($data))
 return $data;

 $non_displayables = array(
 '/%0[0-8bcef]/', // URL encoded 00-08, 11, 12, 14, 15
 '/%1[0-9a-f]/', // url encoded 16-31
 '/[\x00-\x08]/', // 00-08
 '/\x0b/', // 11
 '/\x0c/', // 12
 '/[\x0e-\x1f]/', // 14-31
 '/\27/'
 );
 foreach ($non_displayables as $regex)
 $data = preg_replace( $regex, '', $data);
 $reemplazar = array('"', "'", '=');
 $data = str_replace($reemplazar, "*", $data);
 return $data;
}
</code></pre>

I'm looking for the alternative of <code>mysql_real_escape_string()</code> for SQL Server. Is <code>addslashes()</code> my best option or there is another alternative function that can be used?

An alternative for <code>mysql_error()</code> would also be useful.

How to escape strings in SQL Server using PHP?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在寻找SQL Server的mysql_real_escape_string()的替代方案。addslashes()是我最好的选择，还是有其他可以使用的替代功能？mysql_error()的替代方案也会很有用。

问如何在SQL Server中使用PHP转义字符串？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在SQL Server中使用PHP转义字符串？EN