php - When I update an sql table row with a content "=" there runs an error

Question

I want to run this:

UPDATE users SET about="$about" ;

but when my $about contains =, the script makes a mistake and do something like this:

$about="<img src=somevalue.jpg />";

The script adds this in the database:

<img src

and nothing more.

Answer 1

尝试使用双单引号。

$about = '<img src=somevalue.jpg />';
$query = "UPDATE users SET about='$about'";

作为旁注，SQL Injection如果变量的值（s）来自外部，则查询很容易受到攻击。请看下面的文章，了解如何预防。通过使用PreparedStatements，您可以摆脱在值周围使用单引号。

• 如何防止PHP 中的 SQL 注入？

Answer 2

This is called 'sql injection'. You have to take care of that anyway, so google it.

You have to escape all input you want to use inside statements, anything can happen otherwise. Best is not to use statements constructed by simply including variable content, but use a better engine. Take a look at PDO and the way it works. You "prepare" a statement and hand over parameters as an array. PDO takes care to cleanly escape as required. Much safer that way.

Answer 3

The issue is with putting quotes around string. I'm not very familiar with how php replaces variables in strings but you can try following for MS SQL server:

Set about ="'$about'"