php - 在插入之前插入单引号

Question

我的 php 代码返回一些值，我正在尝试插入数据库。

$string =  '1,here,Skincare composition against free radicals'; //this is returned

'(insert into import (S.No,Name,Title)) values ($string)'  

需要将该字符串转换为正确的格式以插入数据库

'1','here','Skincare composition against free radicals'  //This is expected

内爆应该怎样做？但是我不知道怎么办？

Answer 1

尝试，

$string =  "1,here,Skincare composition against free radicals";
$varList = explode(",", $string);
$newQuery = "INSERT INTO `import` (`S.No`,`Name`,`Title`) VALUES ('" . $varList[0] . "','" . $varList[1] . "','" . $varList[2] . "')";

但是查询容易受到 SQL 注入(inject)的攻击，请阅读下面的文章以了解如何防范它，

• How to prevent SQL injection in PHP?

其他来源

• PHP Explode