1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
<?xml version="1.0" encoding="iso-8859-1"?>
<!-- $Revision: 1.2 $ -->
<refentry id="function.maxdb-real-escape-string">
<refnamediv>
<refname>maxdb_real_escape_string</refname>
<refname>maxdb->real_escape_string</refname>
<refpurpose>
Escapes special characters in a string for use in a SQL statement,
taking into account the current charset of the connection
</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<para>Procedural style:</para>
<methodsynopsis>
<type>string</type><methodname>maxdb_real_escape_string</methodname>
<methodparam><type>resource</type><parameter>link</parameter></methodparam>
<methodparam><type>string</type><parameter>escapestr</parameter></methodparam>
</methodsynopsis>
<para>Object oriented style (method):</para>
<classsynopsis>
<ooclass><classname>maxdb</classname></ooclass>
<methodsynopsis>
<type>string</type>
<methodname>real_escape_sring</methodname>
<methodparam><type>string</type><parameter>escapestr</parameter></methodparam>
</methodsynopsis>
</classsynopsis>
<para>
This function is used to create a legal SQL string that you can use in a SQL statement.
The string <literal>escapestr</literal> is encoded to an escaped SQL string, taking into
account the current character set of the connection.
</para>
<para>
Characters encoded are <literal>', "</literal>.
</para>
</refsect1>
<refsect1>
<title>Return values</title>
<para>
Returns an escaped string.
</para>
</refsect1>
<refsect1>
<title>See also</title>
<para>
<function>maxdb_character_set_name</function>.
</para>
</refsect1>
<refsect1>
<title>Example</title>
<example>
<title>Object oriented style</title>
<programlisting role="php">
<![CDATA[
<?php
$maxdb = new maxdb("localhost", "MONA", "RED", "DEMODB");
/* check connection */
if (maxdb_connect_errno()) {
printf("Connect failed: %s\n", maxdb_connect_error());
exit();
}
$maxdb->query("CREATE TABLE temp.mycity LIKE hotel.city");
$city = "'s Hertogenbosch";
/* this query will fail, cause we didn't escape $city */
if (!$maxdb->query("INSERT into temp.mycity VALUES ('11111','$city','NY')")) {
printf("Error: %s\n", $maxdb->sqlstate);
}
$city = $maxdb->real_escape_string($city);
/* this query with escaped $city will work */
if ($maxdb->query("INSERT into temp.mycity VALUES ('22222','$city','NY')")) {
printf("%d Row inserted.\n", $maxdb->affected_rows);
}
$maxdb->close();
?>
]]>
</programlisting>
</example>
<example>
<title>Procedural style</title>
<programlisting role="php">
<![CDATA[
<?php
$link = maxdb_connect("localhost", "MONA", "RED", "DEMODB");
/* check connection */
if (maxdb_connect_errno()) {
printf("Connect failed: %s\n", maxdb_connect_error());
exit();
}
maxdb_query($link, "CREATE TABLE temp.mycity LIKE hotel.city");
$city = "'s Hertogenbosch";
/* this query will fail, cause we didn't escape $city */
if (!maxdb_query($link, "INSERT into temp.mycity VALUES ('11111','$city','NY')")) {
printf("Error: %s\n", maxdb_sqlstate($link));
}
$city = maxdb_real_escape_string($link, $city);
/* this query with escaped $city will work */
if (maxdb_query($link, "INSERT into temp.mycity VALUES ('22222','$city','NY')")) {
printf("%d Row inserted.\n", maxdb_affected_rows($link));
}
maxdb_close($link);
?>
]]>
</programlisting>
</example>
<para>
The above examples would produce the following output:
</para>
<screen>
<![CDATA[
Warning: maxdb_query(): -5016 POS(43) Missing delimiter: ) <...>
Error: 42000
1 Row inserted.
]]>
</screen>
</refsect1>
</refentry>
<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
indent-tabs-mode:nil
sgml-parent-document:nil
sgml-default-dtd-file:"../../../../manual.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
vim600: syn=xml fen fdm=syntax fdl=2 si
vim: et tw=78 syn=sgml
vi: ts=1 sw=1
-->
|
