PDA

View Full Version : سوال: مشکل insert کردن یک سطر در دیتابیس



moontoise
جمعه 10 اردیبهشت 1389, 17:16 عصر
سلام...
مشکل من اینه که وقتی می خوام با استفاده از کد زیر یک تابع رو به function mysql_query بفرستم, اما متن ارسال شده رو خودبهخود تغییر می ده:


.
.
.

///////////////////////////////////////////////////
/// + Insert data to database
//
function Insert($Table, $ARGS){

if(is_array($ARGS))
foreach($ARGS as $ID=>$ARG){
$IDS[] = $ID;

if($ARG == NULL)
$NARG[] = 'NULL';
else
$NARG[] = mysql_escape_string($ARG);

}

$QUERY = "INSERT HIGH_PRIORITY INTO $Table (`".implode($IDS,'`,`')."`) VALUES ('". implode($NARG, "','") ."')";


if($this->Query("$QUERY")) return TRUE; else return FALSE;
}


///////////////////////////////////////////////////
/// + Query runner
//
function Query($Q){
$this->data = NULL;// set data free

//$Query = (string)$Q;// get to function => check sql injection *
$Query = $Q;

if($this->work)
$this->data = mysql_query($Query);
else
$this->data = NULL;

return $this->data;
}


کد کلاس دیتابیس که بالا نوشتم, متن اگه در یک آرایه به تابع insert بفرستم, مثلا:


$CLASS->Insert('articles', array('name' => 'sample name', 'text' => 'sample text'));


که اگه به جای sample text از متنی به صورت زیر استفاده بشه:

Now, on the open water just beyond the marshes, they can smell the oil that threatens everything they know and love.
"Just smelling it, it puts more of a sense of urgency, a sense of fear," Frank Jurisich said.
The brothers hope to get all the oysters they can sell before the oil washes ashore. They filled more than 100 burlap sacks Thursday and stopped to eat some oysters. "This might be our last day," Mitch Jurisich said.
Without the fishing industry, Frank Jurisich said the family "would be lost. This is who we are and what we do."
Louisiana Gov. Bobby Jindal declared a state of emergency so officials could begin preparing for the oil's impact. He also asked the federal government if he could call up 6,000 National Guard troops to help.
In Buras, La., where Hurricane Katrina made landfall in 2005, the owner of the Black Velvet Oyster Bar & Grill couldn't keep his eyes off the television. News and weather shows were making projections that oil would soon inundate the coastal wetlands where his family has worked since the 1860s.
"A hurricane is like closing your bank account for a few days, but this here has the capacity to destroy our bank accounts," said Byron Marinovitch, 47.
"We're really disgusted," he added. "We don't believe anything coming out of BP's mouth."
Mike Brewer, 40, who lost his oil spill response company in the devastation of Hurricane Katrina nearly five years ago, said the area was accustomed to the occasional minor spill. But he feared the scale of the escaping oil was beyond the capacity of existing resources.
"You're pumping out a massive amount of oil," he said. "There is no way to stop it."


این کلاس, این متن رو اینطوری در دیتابیس ذخیره می کنه:

Now, on the open water just beyond the marshes, they can smell the oil that threatens everything they know and love.

\"Just smelling it, it puts more of a sense of urgency, a sense of fear,\" Frank Jurisich said.

The brothers hope to get all the oysters they can sell before the oil washes ashore. They filled more than 100 burlap sacks Thursday and stopped to eat some oysters. \"This might be our last day,\" Mitch Jurisich said.

Without the fishing industry, Frank Jurisich said the family \"would be lost. This is who we are and what we do.\"

Louisiana Gov. Bobby Jindal declared a state of emergency so officials could begin preparing for the oil\'s impact. He also asked the federal government if he could call up 6,000 National Guard troops to help.

In Buras, La., where Hurricane Katrina made landfall in 2005, the owner of the Black Velvet Oyster Bar & Grill couldn\'t keep his eyes off the television. News and weather shows were making projections that oil would soon inundate the coastal wetlands where his family has worked since the 1860s.

\"A hurricane is like closing your bank account for a few days, but this here has the capacity to destroy our bank accounts,\" said Byron Marinovitch, 47.

\"We\'re really disgusted,\" he added. \"We don\'t believe anything coming out of BP\'s mouth.\"

Mike Brewer, 40, who lost his oil spill response company in the devastation of Hurricane Katrina nearly five years ago, said the area was accustomed to the occasional minor spill. But he feared the scale of the escaping oil was beyond the capacity of existing resources.

\"You\'re pumping out a massive amount of oil,\" he said. \"There is no way to stop it.\"

درواقع نه تنها این, بلکه از کد های HTML هم نمی تونم استفاده کنم...:افسرده:

حالا اگه کمکم کنید خیلی لطف بزرگی بهم کردید, خیلی گیرم...:گریه:
:قلب:

yasgig
جمعه 10 اردیبهشت 1389, 20:51 عصر
چون شما از تابع mysql_escape_string استفاده می کنید این باعث میشه که هرجا " یا ' توی متن شما باشه با \" یا \' جایگزین میکنه.این خودش خوبه و از Sql injection جلوگیری میکنه.اون سطرهای اضافی هم به خاطر implode هستش.