PHP Handbuch
Zurück |  | Nach vorne

# mysqli_real_escape_string

(PHP 5)

mysqli_real_escape_string

(no version information, might be only in CVS)

mysqli->real_escape_string -- Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection

## Description

Procedural style:

string mysqli_real_escape_string ( object link, string escapestr)

Object oriented style (method):

class mysqli {
string real_escape_sring ( string escapestr)
}

This function is used to create a legal SQL string that you can use in a SQL statement. The string `escapestr` is encoded to an escaped SQL string, taking into account the current character set of the connection.

Characters encoded are `NUL (ASCII 0), \n, \r, \, ', ", and Control-Z`.

## Return values

Returns an escaped string.

## See also

mysqli_character_set_name().

## Example

Beispiel 1. Object oriented style
`<?php $mysqli = new mysqli("localhost", "my_user", "my_password", "world"); /* check connection */ if (mysqli_connect_errno()) { printf("Connect failed: %s\n", mysqli_connect_error()); exit(); } $mysqli->query("CREATE TEMPORARY TABLE myCity LIKE City"); $city = "'s Hertogenbosch"; /* this query will fail, cause we didn't escape $city */ if (!$mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) { printf("Error: %s\n", $mysqli->sqlstate); } $city = $mysqli->real_escape_string($city); /* this query with escaped $city will work */ if ($mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) { printf("%d Row inserted.\n", $mysqli->affected_rows); } $mysqli->close(); ?>`

Beispiel 2. Procedural style
`<?php $link = mysqli_connect("localhost", "my_user", "my_password", "world"); /* check connection */ if (mysqli_connect_errno()) { printf("Connect failed: %s\n", mysqli_connect_error()); exit(); } mysqli_query($link, "CREATE TEMPORARY TABLE myCity LIKE City"); $city = "'s Hertogenbosch"; /* this query will fail, cause we didn't escape $city */ if (!mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) { printf("Error: %s\n", mysqli_sqlstate($link)); } $city = mysqli_real_escape_string($link, $city); /* this query with escaped $city will work */ if (mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) { printf("%d Row inserted.\n", mysqli_affected_rows($link)); } mysqli_close($link); ?>`

The above examples would produce the following output:

    Error: 42000
    1 Row inserted.

Zurück | Zum Anfang | Nach vorne
mysqli_real_connect | Nach oben | mysqli_real_query