php - 在 magic_quotes 打开的服务器上 INSERT 失败

Question

我一直在努力将数据插入到我的表中。数据从 xml 文件提取到数组中，并且回显结果很好，但插入时失败。

 $dbhost = 'XXXX';
 $dbuser = 'XXXX';
 $dbpass = 'XXXX';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');

if($conn)
 {
echo "Database Connection Successfull...<br /><br />";
 }

$dbname = 'a4027212_footy';
mysql_select_db($dbname) or die('Couldnt connect to database table');

if($dbname)
{
echo "Database ".$dbname." Selected..<br /><br />";
}

  $tweetmeme = "http://api.tweetmeme.com/stories/popular.xml?category=sports-soccer&count=30" ; 

  $xml = @simplexml_load_file($tweetmeme) or die ("no file loaded") ; 
  if($xml)
  {
echo "Tweetmeme XML loaded with ".count($xml->stories->story)." stories in the file..<br /><br />";
  }
 if(get_magic_quotes_gpc())
 {
echo "Magic Quotes is ON<br /><br />";
 }
foreach($xml->stories->story as $story)
{
    $title=$story->title;
$title=mysql_real_escape_string($title);

$url=$story->url;
$url=mysql_real_escape_string($url);

$media_type=$story->media_type;
$media_type=mysql_real_escape_string($media_type);

$created=$story->created_at;
$created=mysql_real_escape_string($created);


$url_count=$story->url_count;
$url_count=mysql_real_escape_string($url_count);

$comment_count=$story->comment_count;
$comment_count=mysql_real_escape_string($comment_count);

$excerpt=$story->excerpt;
$excerpt=mysql_real_escape_string($excerpt);

$sql = "INSERT INTO ft_tweets (title,url,media_type,created_at,mention_count,comment_count,excerpt) VALUES ($title,$url,$media_type,$created,$url_count,$comment_count,$excerpt)";

$result = mysql_query($sql) or die(mysql_error());
if($result)
{
echo "added to database<br />";
}
}
echo "<br /><br />";

有人告诉我，如果字符串中存在特殊字符，插入将会失败，并且 mysql_real_escape_string() 会有所帮助，但事实并非如此。我尝试过有或没有逃避，但均无济于事。

返回的错误信息是:您的 SQL 语法有错误；检查与您的 MySQL 服务器版本相对应的手册，了解使用近“关闭”的正确语法。这里的脚踝看起来很糟糕。在 Twitpic 上)，mysql_real_escape_string( http://twitpic.c ' 在第 1 行

并且 SQL 插入失败。

Answer 1

$sql = "INSERT INTO ft_tweets (title,url,media_type,created_at,mention_count,comment_count,excerpt) VALUES ($title,$url,$media_type,$created,$url_count,$comment_count,$excerpt)";

$title 、 $url 等的单引号在哪里？应该是:

$sql = "INSERT INTO ft_tweets (title,url,media_type,created_at,mention_count,comment_count,excerpt) VALUES ('$title','$url','$media_type','$created','$url_count','$comment_count','$excerpt')";

当然，您可以忽略数字字段的单引号。