PHP mysqli::escape_string方法代碼示例

 public function updatePlayer(IPlayer $player, $lastIP = null, $loginDate = null)
 {
     $name = trim(strtolower($player->getName()));
     if ($lastIP !== null) {
         $this->database->query("UPDATE simpleauth_players SET lastip = '" . $this->database->escape_string($lastIP) . "' WHERE name = '" . $this->database->escape_string($name) . "'");
     }
     if ($loginDate !== null) {
         $this->database->query("UPDATE simpleauth_players SET logindate = " . intval($loginDate) . " WHERE name = '" . $this->database->escape_string($name) . "'");
     }
 }

 public function getStats($playerName)
 {
     $playerName = $this->db->escape_string(trim(strtolower($playerName)));
     $result = $this->db->query("SELECT * FROM tntstats WHERE name = '" . $playerName . "'");
     if ($result instanceof \mysqli_result) {
         $assoc = $result->fetch_assoc();
         $result->free();
         if (isset($assoc["name"]) and $assoc["name"] === $playerName) {
             return $assoc;
         }
     }
     return null;
 }

 /**
  * Экранирует значение
  * @param  string|array $value
  * @param  null         $type
  * @return string
  */
 public function quote($value, $type = null)
 {
     if (is_array($value)) {
         foreach ($value as $key => $val) {
             $q = $this->getQuoteIdentifierSymbol();
             $value[$key] = $q . $this->db->escape_string($value) . $q;
         }
         $quoted_value = implode(', ', $value);
     } else {
         $q = $this->getQuoteIdentifierSymbol();
         $quoted_value = $q . $this->db->escape_string($value) . $q;
     }
     return $quoted_value;
 }

 public function escStr($str)
 {
     if (is_bool($str)) {
         return $str ? "1" : "0";
     }
     return is_string($str) ? "'{$this->mysqli->escape_string($str)}'" : "{$str}";
 }

 /**
  * escaping a string
  * 
  * @param string $str
  * @return string
  */
 public function escape($str)
 {
     if (!$this->ready()) {
         return false;
     }
     return $this->_MySQLi->escape_string($str);
 }

 /**
  * @param PlayerQuitEvent $e
  */
 public function onPlayerQuit(PlayerQuitEvent $e)
 {
     if ($this->getPlayer($e->getPlayer()) == null) {
         $this->AddPlayer($e->getPlayer());
     } else {
         $this->db->query("UPDATE player_stats SET quits = quits +1 WHERE name = '" . $this->db->escape_string($e->getPlayer()->getName()) . "'") or die($this->bd->mysqli_error());
     }
     //$this->db->query("UPDATE player_stats SET quits = quits +1 WHERE name = '".$this->db->escape_string($e->getPlayer()->getName())."'") or die($this->bd->mysqli_error());
 }

 /**
  * Escape a string to be used in a SQL query.
  *
  * @param String $string The string to escape
  *
  * @return Mixed $return The escaped string on success, FALSE on error
  */
 public function escape_string($string)
 {
     $this->connect();
     if ($this->connected === TRUE) {
         return $this->mysqli->escape_string($string);
     } else {
         return FALSE;
     }
 }

 /**
  * Escaped einen String, der durch Nutzereingabe herkommt
  * 
  * @param type $string
  * @return type $string
  * @author Halldor Rolandsson
  */
 public function escapeMethod($string)
 {
     $database = new mysqli($this->dbHost, $this->dbUser, $this->dbPass, $this->dbDatabase);
     if (mysqli_connect_errno()) {
         printf("Connect failed: %s\n", mysqli_connect_error());
         exit;
     }
     $string = $database->escape_string($string);
     $database->close();
     return $string;
 }

 protected function _process_values($values)
 {
     $data = array();
     foreach ($values as $v) {
         if (is_string($v)) {
             $v = $this->_connection->escape_string($v);
         }
         $data[] = $v;
     }
     return $data;
 }

 public function touchIP($ip)
 {
     //		$ip = $this->db->escape_string(implode("", array_map(function($token){
     //			return chr(intval($token));
     //		}, explode(".", $ip))));
     $ip = $this->db->escape_string($ip);
     $result = $this->db->query("SELECT ip FROM {$this->itn} WHERE ip = '{$ip}';");
     $exists = is_array($result->fetch_assoc());
     $result->close();
     if (!$exists) {
         $this->db->query("INSERT INTO {$this->itn} VALUES ('{$ip}');");
     }
     return $exists;
 }

 /**
  * Creates a new SQL-part for this field.
  * (Only adds ' around string typed fields)
  */
 private final function getDataPart($data, $type)
 {
     $ret = "";
     switch ($type) {
         case 'number':
             $ret = $data;
             break;
         case 'string':
             $ret = "'" . $this->db->escape_string($data) . "'";
             break;
         default:
             $ret = "'" . $this->db->escape_string($data) . "'";
     }
     return $ret;
 }

/**
 * Checks a MySQL database for invalid foreign keys, i.e., a keys pointing to missing rows.
 *
 * @author     David Grudl (http://davidgrudl.com)
 * @copyright  Copyright (c) 2008 David Grudl
 * @license    New BSD License
 * @version    1.0
 */
function checkForeignKeys(mysqli $db, $database = NULL)
{
    $keys = $db->query('
		SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME, REFERENCED_TABLE_NAME, REFERENCED_COLUMN_NAME
		FROM information_schema.KEY_COLUMN_USAGE
		WHERE REFERENCED_TABLE_SCHEMA IS NOT NULL' . ($database ? " AND TABLE_SCHEMA='{$db->escape_string($database)}'" : ''));
    foreach ($keys as $key) {
        echo "{$key['TABLE_SCHEMA']} {$key['TABLE_NAME']}.{$key['COLUMN_NAME']}: ";
        foreach ($key as &$identifier) {
            $identifier = '`' . str_replace('`', '``', $identifier) . '`';
        }
        $row = $db->query("\n\t\t\tSELECT COUNT({$key['COLUMN_NAME']})\n\t\t\tFROM {$key['TABLE_SCHEMA']}.{$key['TABLE_NAME']}\n\t\t\tWHERE {$key['COLUMN_NAME']} NOT IN (SELECT {$key['REFERENCED_COLUMN_NAME']} FROM {$key['TABLE_SCHEMA']}.{$key['REFERENCED_TABLE_NAME']})\n\t\t")->fetch_array();
        echo $row[0] ? "found {$row['0']} invalid foreign keys!\n" : "OK\n";
    }
}

 private function cleanCriteria($criteria)
 {
     if (is_numeric($criteria)) {
         if (false !== strpos($criteria, '.')) {
             $criteria = floatval($criteria);
         } else {
             $criteria = intval($criteria);
         }
     } elseif (is_array($criteria)) {
         $criteria = json_encode($criteria);
     } elseif (is_string($criteria)) {
         $criteria = $this->db->escape_string($criteria);
     }
     return $criteria;
 }

             $stmt->execute() or die($stmt->error);
             $tabAdresseId[$rep->idadresse] = array('rue', $mysqliNew->insert_id);
         } else {
             echo '<p>aucun quartier correspondant à ' . $nomQuartier . '</p>';
             $tabAdresseId[$rep->idadresse] = array('erreur', $mysqliNew->insert_id);
         }
     } else {
         if (!empty($rep->nomville)) {
             $nomVille = nettoyeChaine($rep->nomville);
             $stmtTrouveIdVille->execute() or die($stmt->error);
             $stmtTrouveIdVille->bind_result($idVille);
             if ($stmtTrouveIdVille->fetch()) {
                 $stmtTrouveIdVille->free_result();
                 $result = $mysqliNew->query('SELECT idSousQuartier FROM sousQuartier sq WHERE idQuartier=(SELECT idQuartier FROM quartier sq WHERE idVille=' . $idVille . ' AND nom="autre") AND nom="autre"');
                 $reponse = $result->fetch_object();
                 $nom = $mysqliNew->escape_string($nom);
                 $prefixe = $mysqliNew->escape_string($prefixe);
                 // ajout laurent : pour separation prefixe (complement) du nom de la rue
                 $idSousQuartier = $reponse->idSousQuartier;
                 $stmt->execute() or die($stmt->error);
                 $tabAdresseId[$rep->idadresse] = array('rue', $mysqliNew->insert_id);
             } else {
                 echo '<p>aucun quartier correspondant à ' . $nomQuartier . '</p>';
                 $tabAdresseId[$rep->idadresse] = array('erreur', $mysqliNew->insert_id);
             }
         } else {
             echo '<p>PERTE : idadresse = ' . $rep->idadresse . '</p>';
             $tabAdresseId[$rep->idadresse] = array('erreur', $mysqliNew->insert_id);
         }
     }
 }

<?php

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $db = new mysqli('localhost', 'root', '', 'hospital');
    // Prepare data for insertion
    $id = $db->escape_string($_POST["id"]);
    $soort = $db->escape_string($_POST["soort"]);
    // Prepare query and execute
    $query = "insert into species (id, soort) values ('{$id}','{$soort}')";
    $result = $db->query($query);
    // Tell the browser to go back to the index page.
    header("Location: ./");
    exit;
}