mysql_escape_string()

(PHP 4 >= 4.0.3, PHP 5)

转义一个字符串用于 mysql_query

说明

mysql_escape_string(string $unescaped_string): string

本函数将$unescaped_string转义，使之可以安全用于mysql_query()。

Note:mysql_escape_string()并不转义%和_。本函数和mysql_real_escape_string()完全一样，除了mysql_real_escape_string()接受的是一个连接句柄并根据当前字符集转移字符串之外。mysql_escape_string()并不接受连接参数，也不管当前字符集设定。

Example #1 mysql_escape_string()例子

<?php
    $item = "Zak's Laptop";
    $escaped_item = mysql_escape_string($item);
    printf ("Escaped string: %s\n", $escaped_item);
?>

以上例子将产生如下输出：

Escaped string: Zak\'s Laptop

参见mysql_real_escape_string()，addslashes()和magic_quotes_gpc指令。

You can use this function safely with your MySQL database queries if and only if you are sure that your database connection is using ASCII, UTF-8, or ISO-8859-* and that the backslash is your database's escape character. If you're not sure, then use mysqli_real_escape_string instead. This function is not safe to use on databases with multi-byte character sets.
The only benefit of this function is that it does not require a database connection.

The exact characters that are escaped by this function are the null byte (0), newline (\n), carriage return (\r), backslash (\), single quote ('), double quote (") and substiture (SUB, or \032).