如何从db中检索“转义”字符串？

问题描述：

I'm doing this to all strings before inserting them:

mysql_real_escape_string($_POST['position']);

How do I remove the: \ after retriving them?

So I don't end up with: \"Piza\"

Also is this enough security or should I do something else?

Thanks

我在插入之前对所有字符串执行此操作： p>

  mysql_real_escape_string（$ _ POST ['position']）; 
  code>  pre> 
 
 如何在重新执行后删除：\？ p> 
 
 所以我最终不会：\“Piza \” p> 
 
 
这还有足够的安全性还是我应该做些什么呢？ p> 
 
 
 谢谢 p> 
  div>

答

use stripslashes() to get rid of the escape character.

Escaping is great. In case the value is going to be integer , I would suggest you do it like:

$value = (int) $_POST['some_int_field'];

This would make sure you always end up with an integer value.

答

I would suggest you call $_POST['position'] directly (don't call mysql_real_escape_string on it) to get the non-escaped version.

Incidentally your comment about security suggests a bit of trouble understanding things.

One way of handling strings is to handle the escaped versions, which leads to one kind of difficulty, while another is to handle another and escape strings just before embedding, which leads to another kind of difficulty. I much prefer the latter.

答

mysql_real_escape_string() does add \s in your SQL strings but they should not be making it into the database as they are only there for the purpose of string parsing.

If you are seeing \s in you database then something else is escaping your stings before you call mysql_real_escape_string(). Check to make sure that magic_quotes_gpc isn't turned on.

答

It could be because magic quotes are enabled, so to make it versatile, use this:

if (get_magic_quotes_gpc()) { // Check if magic quotes are enabled
        $position = stripslashes($_POST['position']);
    } else {
        $position = mysql_real_escape_string($_POST['position']);
}

如何从db中检索“转义”字符串？

相关推荐