real_escape_string()
PHP mysqli real_escape_string() funksiyasi
Misol - obyektga yo‘naltirilgan uslub
Stringlardagi maxsus belgilarni escape qiling:
<?php
$mysqli = new mysqli("localhost","my_user","my_password","my_db");
if ($mysqli -> connect_errno) {
echo "Failed to connect to MySQL: " . $mysqli -> connect_error;
exit();
}
// Escape special characters, if any
$firstname = $mysqli -> real_escape_string($_POST['firstname']);
$lastname = $mysqli -> real_escape_string($_POST['lastname']);
$age = $mysqli -> real_escape_string($_POST['age']);
$sql="INSERT INTO Persons (FirstName, LastName, Age) VALUES ('$firstname', '$lastname', '$age')";
if (!$mysqli -> query($sql)) {
printf("%d Row inserted.\n", $mysqli->affected_rows);
}
$mysqli -> close();
?>
Protsedural uslubdagi misolni sahifa pastida ko‘ring.
Ta’rif va qo‘llanilishi
real_escape_string() / mysqli_real_escape_string() funksiyasi ulanishning joriy belgilar to‘plamini hisobga olgan holda, SQL so‘rovida ishlatish uchun stringdagi maxsus belgilarni escape qiladi.
Bu funksiya SQL operatorida (statement) ishlatilishi mumkin bo‘lgan to‘g‘ri SQL stringini yaratish uchun ishlatiladi. Faraz qilaylik, bizda quyidagi kod bor:
<?php
$lastname = "D'Ore";
$sql="INSERT INTO Persons (LastName) VALUES ('$lastname')";
// This query will fail, cause we didn't escape $lastname
if (!$mysqli -> query($sql)) {
printf("%d Row inserted.\n", $mysqli->affected_rows);
}
?>
Sintaksis
Obyektga yo‘naltirilgan uslub:
$mysqli -> real_escape_string(escapestring)
Protsedurali uslub:
mysqli_real_escape_string(connection, escapestring)
Parametr qiymatlari
| Parametr | Tavsif |
|---|---|
| connection | Majburiy. Foydalaniladigan MySQL ulanishini belgilaydi |
| escapestring | Majburiy. Escape qilinadigan string. Kodlanadigan belgilar: NUL (ASCII 0), \n, \r, \, ', " va Control-Z. |
Texnik tafsilotlar
| Qaytariladigan qiymat: | Escape qilingan stringni qaytaradi |
|---|---|
| PHP versiyasi: | 5+ |
Misol - protsedural uslub
Stringlardagi maxsus belgilarni escape qiling:
<?php
$con = mysqli_connect("localhost","my_user","my_password","my_db");
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
exit();
}
// Escape special characters, if any
$firstname = mysqli_real_escape_string($con, $_POST['firstname']);
$lastname = mysqli_real_escape_string($con, $_POST['lastname']);
$age = mysqli_real_escape_string($con, $_POST['age']);
$sql="INSERT INTO Persons (FirstName, LastName, Age) VALUES ('$firstname', '$lastname', '$age')";
if (!mysqli_query($con, $sql)) {
printf("%d Row inserted.\n", mysqli_affected_rows($con));
}
mysqli_close($con);
?>
❮ PHP MySQLi ma’lumotnomasi
W3Schools Pathfinder
Yutuqlaringizni kuzating – bu bepul!