PHP：在 PDO exec 之前处理引号

Question

我设计了一个表单，我的意图是接受任何 UTF-8 内容并将其插入 MySQL 数据库。我使用带有 charset utf-8 的 PDO 作为连接数据库的编码。当内容包含单引号等字符时，插入查询仍然失败。在查询中使用输入内容之前，我应该在输入内容上使用什么内置函数。下面是在插入数据库之前形成的示例查询

    INSERT INTO dbname.table 
               (input_xml) 
           VALUES 
               ('<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
            <ip_Input>
                 <ip_xml>
                    Qaiku.com – What Can We 
                    Learn From Failure?By Guest Blogger, September 11, 2012, Leave a 
                    CommentEditor's note: I think we in the tech press have the tendency to 
                    focus on the positive stories and forget about the startups that didn't live up 
                    their expectations. Our Sofanatics coverage this past week has been one of the 
                    few times we've covered abandoned projects, which is a pitty because there are a 
                    lot to learn from "failures." Below we have a long read from Eero Holmila which 
                    is one part eulogy, and another part what he's learned from the now-announced 
                    shutdown of Qaiku.com.Qaiku.com might be a familiar name for some of the 
                    readers of Arctic Startup. However, I am quite sure that the background and the 
                    rough road from high hopes to a bitter decline probably is not. I am the CEO of 
                    Rohea, a company behind a handful of quite successful Finnish websites like 
                    Kotikokki.net, Kuvake.net, Mikseri.net and of course a less successful 
                    Qaiku.com.I am going to share some lessons learned through the trip. I hope 
                    some of it might be of use, spark up ideas or if nothing else, be at least a bit 
                    entertaining. One last important disclaimer: all the opinions are my own.Now 
                    without further delay, this is the story of 
                    Qaiku.
                </ip_xml>
           </ip_Input>
              ');

Answer 1

您应该使用的函数是PDOStatement::bindValue()。在这样做之前，您还应该阅读 SQL 注入以及将 PDO 与参数化查询一起使用的正确方法。