所以目前我的代码是程序格式的,所以为了防止自己在 mysqli_real_escape_string 函数中添加“链接”,我做了一个如下所示的方法:
// Used to create a legal SQL string that you can use in an SQL statement in place of mysqli_real_escape_string
public function escape_string($string) {
$newstring = mysqli_real_escape_string($this->dbconn, $string);
return $newstring;
}
当我使用它时,虽然我没有得到任何结果,但如果您有任何建议,请告诉我。
以下是我使用该函数的一些示例:
function email_exists($email,$dblayer){
$sql = "SELECT `id` FROM `users` WHERE `email` = '" . $dblayer->escape_string($email) . "'";
$results = $dblayer->select_query($sql);
if($results){
return true;
}else{
return false;
}
和这个:
public function pass_reset($email){
$newpass = substr(md5(mt_rand(1,99999)),0,8);
$newpasshash = md5($newpass . '************');
$sql = "UPDATE `admin_users` SET `password` = '" . $newpasshash . "' WHERE `username` = '" . $this->dblayer->escape_string($email) . "'";
$this->dblayer->modify_query($sql);
return $newpass;
}
这是围绕另一个称为 dbobject 的 dblayer 创建的:
case $range:
$dates = explode(',',$_GET['search-string']);
$sql = "SELECT SQL_CALC_FOUND_ROWS * FROM `user_profile` WHERE `created` BETWEEN '" . $dates[0] . "' AND '" . $dates[1] . "'";
break;
default:
$sql = "SELECT SQL_CALC_FOUND_ROWS * FROM `user_profile` WHERE `" . $_GET['search-field'] . "` LIKE '%" . $dbobject->escape_string($_GET['search-string']) . "%'";
break;