Rechercher dans le manuel MySQL
28. 7. 7. 55 mysql _real _escape _string ()
unsigned long mysql_real_escape_string(MYSQL *mysql,
char *to, const char *from, unsigned long length)
Description
This function creates a legal SQL string for use in an SQL statement. See Section 9.1.1, “String Literals”.
mysql_real_escape_string()
fails and produces an
CR_INSECURE_API_ERR
error if
the NO_BACKSLASH_ESCAPES
SQL mode is enabled. In this case, the function cannot
escape quote characters except by doubling them, and to do
this properly, it must know more information about the
quoting context than is available. Instead, use
mysql_real_escape_string_quote()
,
which takes an extra argument for specifying the quoting
context.
The mysql
argument must be a valid, open
connection because character escaping depends on the character
set in use by the server.
The string in the from
argument is encoded
to produce an escaped SQL string, taking into account the
current character set of the connection. The result is placed
in the to
argument, followed by a
terminating null byte.
Characters encoded are \
,
'
, "
,
NUL
(ASCII 0), \n
,
\r
, and Control+Z. Strictly speaking, MySQL
requires only that backslash and the quote character used to
quote the string in the query be escaped.
mysql_real_escape_string()
quotes the other characters to make them easier to read in log
files. For comparison, see the quoting rules for literal
strings and the QUOTE()
SQL
function in Section 9.1.1, “String Literals”, and
Section 12.5, “String Functions and Operators”.
The string pointed to by from
must be
length
bytes long. You must allocate the
to
buffer to be at least
length*2+1
bytes long. (In the worst case,
each character may need to be encoded as using two bytes, and
there must be room for the terminating null byte.) When
mysql_real_escape_string()
returns, the contents of to
is a
null-terminated string. The return value is the length of the
encoded string, not including the terminating null byte.
If you must change the character set of the connection, use
the mysql_set_character_set()
function rather than executing a SET
NAMES
(or SET CHARACTER
SET
) statement.
mysql_set_character_set()
works like SET NAMES
but also
affects the character set used by
mysql_real_escape_string()
,
which SET NAMES
does not.
The following example inserts two escaped strings into an
INSERT
statement, each within single quote
characters:
char query[1000],*end;
end = my_stpcpy(query,"INSERT INTO test_table VALUES('");
end += mysql_real_escape_string(&mysql,end,"What is this",12);
end = my_stpcpy(end,"','");
end += mysql_real_escape_string(&mysql,end,"binary data: \0\r\n",16);
end = my_stpcpy(end,"')");
if (mysql_real_query(&mysql,query,(unsigned int) (end - query)))
{
fprintf(stderr, "Failed to insert row, Error: %s\n",
mysql_error(&mysql));
}
The my_stpcpy()
function used in the
example is included in the libmysqlclient
library and works like strcpy()
but returns
a pointer to the terminating null of the first parameter.
The length of the encoded string that is placed into the
to
argument, not including the terminating
null byte, or -1 if an error occurs.
Because
mysql_real_escape_string()
returns an unsigned value, you can check for -1 by comparing
the return value to (unsigned long)-1
(or
to (unsigned long)~0
, which is equivalent).
This error occurs if the
NO_BACKSLASH_ESCAPES
SQL mode is enabled because, in that case,mysql_real_escape_string()
cannot be guaranteed to produce a properly encoded result. To avoid this error, usemysql_real_escape_string_quote()
instead.
Document created the 26/06/2006, last modified the 26/10/2018
Source of the printed document:https://www.gaudry.be/en/mysql-rf-mysql-real-escape-string.html
The infobrol is a personal site whose content is my sole responsibility. The text is available under CreativeCommons license (BY-NC-SA). More info on the terms of use and the author.
References
These references and links indicate documents consulted during the writing of this page, or which may provide additional information, but the authors of these sources can not be held responsible for the content of this page.
The author This site is solely responsible for the way in which the various concepts, and the freedoms that are taken with the reference works, are presented here. Remember that you must cross multiple source information to reduce the risk of errors.