PHP 手冊
前一頁 |  | 下一頁

# PDO::quote

(no version information, might be only in CVS)

PDO::quote -- Quotes a string for use in a query.

## Description

string PDO::quote ( string string [, int parameter_type] )

警告
這個函數是實驗性質的。這個函數的行為、名稱、和關於此函數的任何其他文件在未來PHP的發行中可能會在不通知的情況下改變。 使用此延伸需自行承擔風險。

PDO::quote() places quotes around the input string and escapes and single quotes within the input string. Quoting input strings has been a common means of attempting to prevent SQL injection attacks; however, an even safer approach is to use prepared statements with named parameters or placeholders for the input values.

Not all PDO drivers implement this method.

## Parameters

string

  The string to be quoted.

parameter_type

  Provides a data type hint for drivers that have alternate quoting styles. The default value is PDO_PARAM_STR.

## Return Values

Returns a quoted string that is theoretically safe to pass into an SQL statement.

## 範例

範例 1. Quoting a normal string
`<?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Simple string */ $string = 'Nice'; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?>`
The above example will output:
    Unquoted string: Nice
    Quoted string: 'Nice'

範例 2. Quoting a dangerous string
`<?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Dangerous string */ $string = 'Naughty \' string'; print "Unquoted string: $string\n"; print "Quoted string:" . $conn->quote($string) . "\n"; ?>`
The above example will output:
    Unquoted string: Naughty ' string
    Quoted string: 'Naughty '' string'

範例 3. Quoting a complex string
`<?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Complex string */ $string = "Co'mpl''ex \"st'\"ring"; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?>`
The above example will output:
    Unquoted string: Co'mpl''ex "st'"ring
    Quoted string: 'Co''mpl''''ex "st''"ring'

## 參考

PDO::prepare()
PDOStatement::execute()

前一頁 | 內容 | 下一頁
PDO::query | 上一層 | PDO::rollBack