PDO::quote

Descrizione

PDO::quote() places quotes around the input string and escapes and single quotes within the input string. Quoting input strings has been a common means of attempting to prevent SQL injection attacks; however, an even safer approach is to use prepared statements with named parameters or placeholders for the input values.

Not all PDO drivers implement this method.

Elenco dei parametri

Valori restituiti

Returns a quoted string that is theoretically safe to pass into an SQL statement.

Esempi

Esempio 1. Quoting a normal string <?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Simple string */ $string = 'Nice'; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?> The above example will output: Unquoted string: Nice Quoted string: 'Nice'

Esempio 2. Quoting a dangerous string <?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Dangerous string */ $string = 'Naughty \' string'; print "Unquoted string: $string\n"; print "Quoted string:" . $conn->quote($string) . "\n"; ?> The above example will output: Unquoted string: Naughty ' string Quoted string: 'Naughty '' string'

Esempio 3. Quoting a complex string <?php $conn = new PDO('sqlite:/home/lynn/music.sql3'); /* Complex string */ $string = "Co'mpl''ex \"st'\"ring"; print "Unquoted string: $string\n"; print "Quoted string: " . $conn->quote($string) . "\n"; ?> The above example will output: Unquoted string: Co'mpl''ex "st'"ring Quoted string: 'Co''mpl''''ex "st''"ring'

Vedere anche: